Repository navigation
fix catastrophic backtracking in _ansi_escape_pat OSC 8 params - #498
Open
Chandan3456 wants to merge 1 commit into
Open
Chandan3456 wants to merge 1 commit into
Chandan3456 wants to merge 1 commit into
Conversation
The params group (\w+=\w+:?)* lets adjacent key=value pairs abut without a colon, so a run of word characters between two '=' can be split in many ways and an unterminated OSC 8 sequence such as "\x1b]8;a=" + "aaaa=" * 18 backtracks exponentially. tabulate() runs this regex over every cell, so 96 bytes of input take ~30 s. Require colon-separated pairs, as in the OSC 8 spec. Matching becomes linear, the capture groups stay the same, and well-formed params match as before.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
the OSC 8 params group
(\w+=\w+:?)*in_ansi_escape_patmakes the colon between pairs optional, so a run of word characters between two=can be split across adjacent pairs in many ways and an unterminated sequence backtracks exponentially (ReDoS, CWE-1333).tabulate()runs_ansi_codes.searchover every header and cell on every call, for anytablefmtand from the cli, so a 96 byte cell"\x1b]8;a=" + "aaaa=" * 18takes ~32 s on master and each extraaaaa=costs ~9x. requiring the colon, as the OSC 8 spec writes params (id=x:foo=bar), makes the match linear: that cell now takes under 0.1 ms and a 500 kB one ~4 ms. the capture groups are unchanged, valid links with or without params match exactly as before (checked exhaustively against the old group for all params up to 10 chars), and the only params that stop matching are two pairs run together with no colon, which the spec doesn't allow. #443 drops this group inside a larger OSC 8 rewrite and #495 widens it to[\w.-]+, which keeps the backtracking, so this is the minimal fix on its own; the added test fails on master after ~7 s.