linode / linode/linode-cli

[Bug]: Overly permissive regular expression range

Abierto
#734 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

bug
Lenguaje dominante
Python
Estrellas
442
Forks
159
Merge medio
7 d 21 h
PR fusionados (30 d)
8

Descripción

### CLI Version

v5.56.2

### Command

https://github.com/linode/linode-cli/blob/fafe73e1f48a48ab9cbdf9b01f679e041f6bf3fa/tests/integration/stackscripts/test_stackscripts.py#L95-L95

It's easy to write a regular expression range that matches a wider range of characters than you intended. `/[a-zA-z]/` matches all lowercase and all uppercase letters, as you would expect, but it also matches the characters: `[ \ ] ^ _ ``.

Another common problem is failing to escape the dash character in a regular expression. An unescaped dash is interpreted as part of a range. For example, in the character class `[a-zA-Z0-9%=.,-_]` the last character range matches the 55 characters between `,` and `_` (both included), which overlaps with the range `[0-9]` and is clearly not intended by the writer.

### Output

_No response_

### Expected Behavior

[CWE-20

### Actual Behavior

Improper Neutralization of Special Elements used in a Command in Shell-quote
[Exploiting CVE-2021-42740](https://wh0.github.io/2021/10/28/shell-quote-rce-exploiting.html)
[no-obscure-range](https://ota-meshi.github.io/eslint-plugin-regexp/rules/no-obscure-range.html)
[The regex [,-.]](https://pboyd.io/posts/comma-dash-dot/)
[CWE-20](https://cwe.mitre.org/data/definitions/20.html).

### Steps to Reproduce

## POC
The following code is intended to check whether a string is a valid 6 digit hex color.
```python
import re
def is_valid_hex_color(color):
return re.match(r'^#[0-9a-fA-f]{6}$', color) is not None
```
However, the `A-f` range is overly large and matches every uppercase character. It would parse a "color" like `#XXYYZZ` as valid.

The fix is to use an uppercase A-F range instead.

```python
import re
def is_valid_hex_color(color):
return re.match(r'^#[0-9a-fA-F]{6}$', color) is not None
```

## Recommendation
Avoid any confusion about which characters are included in the range by writing unambiguous regular expressions. Always check that character ranges match only the expected characters.

Guía de contribución

Abrir la guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Línea de trabajo

El issue apunta a tests/integration/stackscripts/test_stackscripts.py en la línea 95; inspecciona allí la expresión regular y su cobertura existente. Verifica que los rangos de caracteres acepten únicamente los caracteres previstos, actualiza la prueba o la expresión correspondiente y ejecuta la prueba de integración asociada.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
python
Área
cli, security
Tipo de issue
Error
Dificultad
2/5
Tiempo estimado
1-3 horas
Estado de actividad
Estancado
Claridad
Bastante claro
Aptitud para principiantes
45/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.