GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — bpo-41712: Vulnerable regex changed by Pixmew · Pull Request #23166 · python/cpython

Conversation

@Pixmew

@Pixmew Pixmew commented Nov 5, 2020 •
edited by bedevere-bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Using suggestion ""For example, you can modify the sub-pattern \w+\d+ to ([A-Za-z_]*\d)+"" and converted to ([A-za-z_]+\d+)
which should Fix the issue of vulnerable regex. ""can be exploited with the following string "1.1.1"+"1" * 5000 + "!" ""

Test Result : Working as intended
Sorry if this not much this is my first pr to big org.

https://bugs.python.org/issue41712

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
Pixmew added 2 commits November 5, 2020 20:41
@Pixmew
Unnessery regex conditions are removed
eac3276
bpo-41712: Removal of Unnessery regex conditions  
Using suggestion 
For example, you can modify the sub-pattern \w+\d+ to ([A-Za-z_]*\d)+
which should Fix the issue of vulnerable regex.
Test Result : Working as intended

Sorry if this not much this is my first pr to big org.
@Pixmew
Vulnerable regex conditions are removed
f3f4725
bpo-41712: Removal of Vulnerable regex conditions  
Using suggestion  ""For example, you can modify the sub-pattern \w+\d+ to ([A-Za-z_]*\d)+""  and converted to ([A-za-z_]+\d+)
which should Fix the issue of vulnerable regex.
Test Result : Working as intended

Sorry if this not much this is my first pr to big org.
@Pixmew
Pixmew requested a review from a team as a code owner November 5, 2020 15:48
@the-knights-who-say-ni the-knights-who-say-ni added the CLA not signed label Nov 5, 2020
@the-knights-who-say-ni

the-knights-who-say-ni commented Nov 5, 2020

Copy link
Copy Markdown

Hello, and thanks for your contribution!

I'm a bot set up to make sure that the project can legally accept this contribution by verifying everyone involved has signed the PSF contributor agreement (CLA).

CLA Missing

Our records indicate the following people have not signed the CLA:

@Pixmew

For legal reasons we need all the people listed to sign the CLA before we can look at your contribution. Please follow the steps outlined in the CPython devguide to rectify this issue.

If you have recently signed the CLA, please wait at least one business day
before our records are updated.

You can check yourself to see if the CLA has been received.

Thanks again for the contribution, we look forward to reviewing it!

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@bedevere-bot bedevere-bot added the awaiting review label Nov 5, 2020
@the-knights-who-say-ni the-knights-who-say-ni added CLA signed and removed CLA not signed labels Nov 6, 2020
@blurb-it
📜🤖 Added by blurb_it.
8e502ad
Pixmew
Pixmew commented Nov 6, 2020
View reviewed changes

@Pixmew Pixmew left a comment

Copy link
Copy Markdown
Contributor Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should work

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
Pixmew and others added 4 commits November 6, 2020 13:18
@Pixmew
edited
9a4c1a5
@Pixmew
edited for avoiding docs failure
fddf4f1
@blurb-it
📜🤖 Added by blurb_it.
d4004c6
@Pixmew
linux test failure reason
40b6373
Fidget-Spinner
Fidget-Spinner reviewed Nov 7, 2020
View reviewed changes

@Fidget-Spinner Fidget-Spinner left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello, thanks for your first PR to CPython. I'm not a core dev but I'll do my best to try address some of this.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
Comment thread Misc/NEWS.d/next/Tools-Demos/2020-11-06-09-12-13.bpo-41712.WOEkdm.rst Resolved

Uh oh!

There was an error while loading. Please reload this page.

Fidget-Spinner
Fidget-Spinner reviewed Nov 7, 2020
View reviewed changes
Comment thread Tools/msi/purge.py Resolved

Uh oh!

There was an error while loading. Please reload this page.

Pixmew and others added 2 commits November 7, 2020 12:16
@Pixmew @Fidget-Spinner
Update Misc/NEWS.d/next/Tools-Demos/2020-11-06-09-12-13.bpo-41712.WOE…
52f7af2
…kdm.rst

Co-authored-by: kj <[email protected]>
@Pixmew @Fidget-Spinner
Update Tools/msi/purge.py
eb1500c
Co-authored-by: kj <[email protected]>
@Pixmew

Pixmew commented Nov 7, 2020 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor Author

Thank you Sir for your suggestions it helped me a lot.
and \w was replaced by [A-Za-z_] because \w also contains some extra characters as well which may not be valid for our task.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@Pixmew
Pixmew removed the request for review from a team November 7, 2020 07:53
@Pixmew
Updated news
aab27c2
@Pixmew

Pixmew commented Nov 7, 2020 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor Author

sorry i accendenttly removed reviewer what should i do
@Fidget-Spinner #23166

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Fidget-Spinner
Fidget-Spinner approved these changes Nov 7, 2020
View reviewed changes
@bedevere-bot bedevere-bot added awaiting core review and removed awaiting review labels Nov 7, 2020
@Pixmew

Pixmew commented Nov 7, 2020 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor Author

Sir what is core review

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@Pixmew Pixmew changed the title bpo-41712: Vulnerable regex changes as suggested bpo-41712: Vulnerable regex changed Nov 7, 2020
@Pixmew
Pixmew marked this pull request as draft November 7, 2020 13:12
@Pixmew
Pixmew marked this pull request as ready for review November 7, 2020 13:12
@Pixmew Pixmew mentioned this pull request Nov 7, 2020
bpo-40170: Add PyType_SetBase() function #23153
Closed
@Pixmew Pixmew closed this Nov 7, 2020
@Pixmew Pixmew reopened this Nov 7, 2020
@Pixmew Pixmew closed this Nov 7, 2020
@Pixmew

Pixmew commented Nov 7, 2020 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor Author

@Fidget-Spinner Sir can you please review the PR #23191
I Reapplide for PR because previous/This PR #23166 was not working as inteded due to my mistake
It was not requesting for review core review so i had to close this PR and file a new PR

Thnakyou sir

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@Fidget-Spinner

Fidget-Spinner commented Nov 7, 2020 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

Sorry, I don't think you should open multiple PRs because it makes it harder to track the development of a solution. Maybe reopen this one and close the other? (I don't see any difference between the two anyways)

I'm not a core developer. The awaiting core review tag means it's waiting for a core developer to approve this PR. Probably one of the core developers who commented on the issue in bugs.python will review/approve it eventually. They receive mail notifications for the PR after all.

These things take time - a core developer may take up to a month, or maybe even longer to take a look at your PR. So I recommend exercising patience. The core devs are mostly doing this out of their own free time.

If nobody looks at your PR after maybe 2 - 4 weeks, you can comment on the bugs.python.org issue and ask for a PR.

Edit: BTW you don't have to @ me in your comments, I already receive notifications for your replies anyways.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@Pixmew

Pixmew commented Nov 7, 2020

Copy link
Copy Markdown
Contributor Author

Thankyou sir but it dosent say requested review
and i did this by mistake:
Pixmew removed the request for review from python/windows-team 8 hours ago

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@Pixmew

Pixmew commented Nov 7, 2020 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor Author

What do you think i should do
reopen this and close other one?

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@Fidget-Spinner

Fidget-Spinner commented Nov 7, 2020 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

What do you think i should do reopen this and close other one?

Yes. Also I'd recommend this:

If nobody looks at your PR after maybe 2 - 4 weeks, you can comment on the bugs.python.org issue and ask for a PR.

The request for review isn't required. They can review it even without that.

Pinging @zooba for this, sorry for the noise generated.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@Pixmew

Pixmew commented Nov 7, 2020

Copy link
Copy Markdown
Contributor Author

Ok Sir Thankyou. You have been are very Kind and helpfull.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@Pixmew Pixmew reopened this Nov 7, 2020
@Pixmew
Update news
c35c75f
@zooba zooba added the skip news label Nov 9, 2020
@zooba
Remove NEWS file
52ea444
@zooba

zooba commented Nov 9, 2020

Copy link
Copy Markdown
Member

Thanks for the contribution! This doesn't need a NEWS entry, so I added the tag and removed the file (I'm worried it may concern people who read updates, because it mentions a vulnerability that they were never vulnerable to).

Once CI clears, I'll merge it.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@zooba

zooba commented Nov 9, 2020

Copy link
Copy Markdown
Member

For future contributions, you may also want to work from a branch in your repository, rather than master (see step 2 at https://devguide.python.org/pullrequest/#step-by-step-guide).

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@Pixmew

Pixmew commented Nov 9, 2020

Copy link
Copy Markdown
Contributor Author

Thanks you Sir
And I don't mean any disrespects about the vulnerability but it was title as vulnerability in the issue tracker so I decided to use that.If you want I can change it.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@zooba
zooba merged commit 1f73c32 into python:master Nov 9, 2020
@bedevere-bot bedevere-bot removed the awaiting core review label Nov 9, 2020
@zooba

zooba commented Nov 9, 2020

Copy link
Copy Markdown
Member

No problems at all. There is no product impact from this change, so it doesn't need to be listed in the product changes :)

Copying the title of the original bug is fine, though in this case we quickly determined that the title was inaccurate (but never changed it).

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

adorilson pushed a commit to adorilson/cpython that referenced this pull request Mar 13, 2021
@Pixmew @adorilson
bpo-41712: Avoid runaway regex match in upload scripts (pythonGH-23166)
9261dbc
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Fidget-Spinner Fidget-Spinner Fidget-Spinner approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

skip news

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

5 participants

@Pixmew @the-knights-who-say-ni @Fidget-Spinner @zooba @bedevere-bot
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.