3 ms·

Here's the changeset that fixes it: http://code.djangoproject.com/changeset/11603 http://code.djangoproject.com/changeset/11603

• mseebach 17y ago
  Could someone as an intellectual exercise explain how this exploit works? I understand the idea of how some strings can throw a regex FSM off its game, but I can't see how it would happen here.
  • gojomo 17y ago
    A simple rule of thumb is: nested repetitions may take 'forever' to fail. If you've got Java applet support in your browser, here's an animated example... http://regex.powertoy.org/?pat=m/((a{0,5}){0,5})*[e]/g&anim=1&rep=m/((a{0,5}){0,5})*[e]/g&in=aaaaaaaaaaaa http://regex.powertoy.org/?pat=m/((a{0,5}){0,5})*[e]/g&a... ...based on the "WARNING: Particularly complicated..." example in the Perlre docs: http://perldoc.perl.org/perlre.html http://perldoc.perl.org/perlre.html You can see that Django's problematic domain-validation regexes were similar to the perlre example, but even worse -- a one-or-more of unbounded length, inside a 0-or-more of unbounded length, inside a 1-or-more of unbounded length: http://code.djangoproject.com/changeset/11603#file0 http://code.djangoproject.com/changeset/11603#file0