From 7ddd872c63a9465340eadae59868d85ac1d43e67 Mon Sep 17 00:00:00 2001 From: Toshio Kuratomi Date: Mon, 15 Jul 2013 12:35:21 -0700 Subject: Fix backported ssl_match_hostname for http://bugs.python.org/issue17980 --- setuptools/ssl_support.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) (limited to 'setuptools') diff --git a/setuptools/ssl_support.py b/setuptools/ssl_support.py index 2aec655a..f8a780a9 100644 --- a/setuptools/ssl_support.py +++ b/setuptools/ssl_support.py @@ -88,9 +88,16 @@ except ImportError: class CertificateError(ValueError): pass - def _dnsname_to_pat(dn): + def _dnsname_to_pat(dn, max_wildcards=1): pats = [] for frag in dn.split(r'.'): + if frag.count('*') > max_wildcards: + # Issue #17980: avoid denials of service by refusing more + # than one wildcard per fragment. A survery of established + # policy among SSL implementations showed it to be a + # reasonable choice. + raise CertificateError( + "too many wildcards in certificate DNS name: " + repr(dn)) if frag == '*': # When '*' is a fragment by itself, it matches a non-empty dotless # fragment. -- cgit v1.2.1