5 ms·
For another real-world example, see "Details of the Cloudflare outage on July 2, 2019" [1] Python `re` module now supports possessive quantifiers and atomic gr
by asicsp 4y ago
For another real-world example, see "Details of the Cloudflare outage on July 2, 2019" [1]
Python `re` module now supports possessive quantifiers and atomic grouping (I wrote a blog post here [2]). So, for example, `(a+|\w+)*+:` instead of `(a+|\w+)*:` will avoid such catastrophic behavior.
[1] https://blog.cloudflare.com/details-of-the-cloudflare-outage-on-july-2-2019/ https://blog.cloudflare.com/details-of-the-cloudflare-outage...
[2] https://learnbyexample.github.io/python-regex-possessive-quantifier/ https://learnbyexample.github.io/python-regex-possessive-qua...
- Alex3917 4y agoWhile atomic grouping can prevent this from happening again once you've already found the problem, the real solution is just making sure there is a timeout on your web process. That way even if you hit catastrophic backtracking, your servers aren't going to be unavailable unless someone is purposely reDOSing them.
- tyingq 4y agoThis paper goes over the Cloudflare outage, and other runaway regex CVEs with MediaWiki, Stackoverflow, and the Atom editor: https://vtechworks.lib.vt.edu/bitstream/handle/10919/98593/Davis_JC_D_2020.pdf https://vtechworks.lib.vt.edu/bitstream/handle/10919/98593/D...
- execveat 4y agoThere's a cool tool to detect regexes like these in your code: https://github.com/doyensec/regexploit https://github.com/doyensec/regexploit (disclosure: I work for Doyensec)
- kh1 4y agoThe gif showing the backtracking is cool. I wonder if there's similar tool for python.