[BUG] Inneficient Regex
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 2.9k
- Forks
- 1.4k
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 1
Description
setuptools version
<=68.2.2
Python version
Python 3.*
OS
Any
Additional environment information
No response
Description
setuptools includes a regex for parsing wheels filenames that is vulnerable to catastrophic backtracking. Thus, potentially allowing Regular expression Denial of Service (ReDoS) attacks through its functionality.
https://github.com/pypa/setuptools/blob/main/setuptools/wheel.py#L22
A very similar flaw in wheel was patched and assigned CVE-2022-40898 in November 2022.
https://github.com/pypa/wheel/commit/44193907eb308930de05deed863fb4d157c5c866
https://github.com/pypa/wheel/commit/88f02bc335d5404991e532e7f3b0fc80437bf4e0
Expected behavior
Wheel name parsing not runs in polynomial time.
How to Reproduce
from setuptools import wheel
payload = '0-0' + '-'*1000
wheel.Wheel(payload)
Output
[hangs]
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at setuptools/wheel.py:22 and reproduce the provided payload against wheel.Wheel. Read the linked wheel commits for context on the analogous fix and trace how the filename regex is used. Done means malformed wheel names no longer cause catastrophic or polynomial-time hangs, with regression coverage for the reported case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- build-system, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100