Skip to content

Fix #8175: intersphinx: Potential of regex denial of service by inventory#8225

Merged
tk0miya merged 1 commit intosphinx-doc:3.xfrom
tk0miya:8175_intersphinx_redos
Sep 28, 2020
Merged

Fix #8175: intersphinx: Potential of regex denial of service by inventory#8225
tk0miya merged 1 commit intosphinx-doc:3.xfrom
tk0miya:8175_intersphinx_redos

Conversation

@tk0miya
Copy link
Copy Markdown
Member

@tk0miya tk0miya commented Sep 20, 2020

Feature or Bugfix

  • Bugfix

Purpose

@tk0miya tk0miya force-pushed the 8175_intersphinx_redos branch from 4383819 to f7b872e Compare September 27, 2020 16:35
@tk0miya tk0miya merged commit d8c006f into sphinx-doc:3.x Sep 28, 2020
@tk0miya tk0miya deleted the 8175_intersphinx_redos branch September 28, 2020 16:58
bskinn added a commit to bskinn/sphobjinv that referenced this pull request Feb 7, 2021
Celery has some duplicate objects in the inventory, which Sphinx
ignores but sphobjinv does not.

OpenCV has objects that are not parsed correctly by Sphinx after the
regex change in sphinx-doc/sphinx#8225, but that sphobjinv
currently reads without difficulty.

A decision will have to be made whether to follow sphinx#8225's fix for
the DOS potential reported in sphinx#8175, or implement one of
the other less-susceptible regexes suggested in sphinx#8175.

Prefer the latter option, as it won't require post-processing
of a combined domain:role.
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Jul 23, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant