From ac0ca050046f1538346f3975487062186195f4ca Mon Sep 17 00:00:00 2001 From: Bert JW Regeer Date: Sun, 2 Feb 2020 15:09:09 -0800 Subject: Remove catastrophic backtracking in regex This updates the regular expression so that there is no longer a chance for it to end up catastrophically backtracking and locking up the process. --- waitress/rfc7230.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/waitress/rfc7230.py b/waitress/rfc7230.py index 97a90a4..cd33c90 100644 --- a/waitress/rfc7230.py +++ b/waitress/rfc7230.py @@ -40,13 +40,13 @@ VCHAR = r"\x21-\x7e" # field-vchar ] FIELD_VCHAR = "[" + VCHAR + OBS_TEXT + "]" -FIELD_CONTENT = FIELD_VCHAR + "([ \t" + VCHAR + OBS_TEXT + "]+" + FIELD_VCHAR + "){,1}" -FIELD_VALUE = "(" + FIELD_CONTENT + "){0,}" +# Field content is more greedy than the ABNF, in that it will match the whole value +FIELD_CONTENT = FIELD_VCHAR + "+(?:[ \t]+" + FIELD_VCHAR + "+)*" +# Which allows the field value here to just see if there is even a value in the first place +FIELD_VALUE = "(?:" + FIELD_CONTENT + ")?" HEADER_FIELD = re.compile( tobytes( "^(?P" + TOKEN + "):" + OWS + "(?P" + FIELD_VALUE + ")" + OWS + "$" ) ) - -OWS_STRIP = re.compile(OWS + "(?P.*?)" + OWS) -- cgit v1.2.1