Regular Expression DoS vulnerability in third-party script

Describe the bug
We are working on the ReDoS problem and detected a vulnerable regex from your code.

Regex \001?\033\\]((?:.|;)*?)(\x07)\002? in link takes forever to match the string
"\u001B];;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n"
This is because two branches in (?:.|;) can both match the character ;, we suggest you to just remove the later one.

We didn’t create a pull request because we're not sure if these cases are possible to take place in your program, we also do not understand the functionality of the regex as you do. Thank you for your understanding.

This is a thirdparty module (as you can see, the path is thirdparty/colorama/ansitowin32.py
To actually reach this piece of code, sqlmap should output the "problematic" string to the console on Win32 (highly unlikely - but I won't judge this)
Out of curiosity and fun, did the example you provided:

$ python
>>> import re
>>> import time
>>> start=time.time(); re.search("\001?\033\\]((?:.|;)*?)(\x07)\002?", "\u001B];;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n"); end=time.time()
>>> print end-start
0.000715017318726
>>>

~~4) Closing this down as invalid. Please do a proper research before raising this kind of issues~~

More info can be found here

Fixes sqlmapproject#4220

Navigation Menu

Repository navigation

Regular Expression DoS vulnerability in third-party script #4220

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Regular Expression DoS vulnerability in third-party script #4220

Description

Activity

stamparm commented on May 29, 2020

stamparm commented on Jun 1, 2020

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions