mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-04 00:48:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

[3.9] bpo-46474: Avoid REDoS in EntryPoint.pattern (sync with importlib_metadata 4.10.1) (GH-30803). (GH-30828)

Browse source 
(cherry picked from commit 51c3e28c8a)

Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>
This commit is contained in:
Jason R. Coombs 2022-01-23 10:17:41 -05:00 • committed by GitHub
parent d0852c447a
commit 1514d1252f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Lib/importlib/metadata.py
View file

@ -49,8 +49,8 @@ class EntryPoint(
pattern = re.compile(
r'(?P<module>[\w.]+)\s*'
r'(:\s*(?P<attr>[\w.]+))?\s*'
r'(?P<extras>\[.*\])?\s*$'
r'(:\s*(?P<attr>[\w.]+)\s*)?'
r'((?P<extras>\[.*\])\s*)?$'
)
"""
A regular expression describing the syntax for an entry point,

2
Misc/NEWS.d/next/Library/2022-01-22-14-49-10.bpo-46474.eKQhvx.rst Normal file
View file

@ -0,0 +1,2 @@
In ``importlib.metadata.EntryPoint.pattern``, avoid potential REDoS by
limiting ambiguity in consecutive whitespace.