Skip to content

Vulnerable Regular Expression in inventory #8175

@yetingli

Description

@yetingli

Type of Issue
Potential Regex Denial of Service (ReDoS)

Description
The vulnerable regular expression is located in

m = re.match(r'(?x)(.+?)\s+(\S*:\S*)\s+(-?\d+)\s+?(\S*)\s+(.*)',

The ReDOS vulnerability of the regex is mainly due to the sub-patterns (\S*:\S*) and can be exploited with the following string
" " + ":" * 5000

I think you can limit the input length or modify this regex.

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions