From 0d2f7b32cbfa1d54deaced54083f1413bec22c6d Mon Sep 17 00:00:00 2001 From: Kevin Backhouse Date: Thu, 16 Mar 2023 10:42:06 +0000 Subject: [PATCH 1/2] Regression test for ReDoS (GHSL-2021-110) --- tests/test_url.py | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/test_url.py b/tests/test_url.py index 2252f24d..d9805c53 100644 --- a/tests/test_url.py +++ b/tests/test_url.py @@ -134,6 +134,7 @@ def test_returns_true_on_valid_public_url(address, public): 'http://[2010:836B:4179::836B:4179', 'http://2010:836B:4179::836B:4179', 'http://2010:836B:4179::836B:4179:80/index.html', + 'http://0.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.', # ReDoS ]) def test_returns_failed_validation_on_invalid_url(address): assert isinstance(url(address), ValidationFailure) From e47c4c2829bf6d10a37a53ba086fb7a01cc30746 Mon Sep 17 00:00:00 2001 From: Kevin Backhouse Date: Thu, 16 Mar 2023 10:46:09 +0000 Subject: [PATCH 2/2] Fix ReDoS (GHSL-2021-110) --- validators/url.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/validators/url.py b/validators/url.py index 37d946cb..77a8973f 100644 --- a/validators/url.py +++ b/validators/url.py @@ -70,10 +70,10 @@ r")\]|" # host name r"(?:(?:(?:xn--[-]{0,2})|[a-z\u00a1-\uffff\U00010000-\U0010ffff0-9]-?)*" - r"[a-z\u00a1-\uffff\U00010000-\U0010ffff0-9]+)" + r"[a-z\u00a1-\uffff\U00010000-\U0010ffff0-9])" # domain name r"(?:\.(?:(?:xn--[-]{0,2})|[a-z\u00a1-\uffff\U00010000-\U0010ffff0-9]-?)*" - r"[a-z\u00a1-\uffff\U00010000-\U0010ffff0-9]+)*" + r"[a-z\u00a1-\uffff\U00010000-\U0010ffff0-9])*" # TLD identifier r"(?:\.(?:(?:xn--[-]{0,2}[a-z\u00a1-\uffff\U00010000-\U0010ffff0-9]{2,})|" r"[a-z\u00a1-\uffff\U00010000-\U0010ffff]{2,}))"