Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

gh-134873: Fix a DOS issue inposixpath#134927

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Closed
Wulian233 wants to merge1 commit intopython:mainfromWulian233:posixpath-dos

Conversation

Wulian233
Copy link
Contributor

@Wulian233Wulian233 commentedMay 30, 2025•
edited by bedevere-appbot
Loading

importtimeimportosimportposixpathimportLib.posixpathasposixpath_fixedos.environ['A']='x'payload="$A"*100000print("Payload size:",len(payload))start=time.time()posixpath.expandvars(payload)print("Original time:",time.time()-start,"seconds")start=time.time()posixpath_fixed.expandvars(payload)print("Fixed time:",time.time()-start,"seconds")

Above is a code that reproduces the problem, and the speed difference becomes more and more noticeable with the number of times. The above 200,000 times is 15x faster

print:

Payload size: 200000Original time: 1.7329566478729248 secondsFixed time: 0.11450839042663574 seconds

@ZeroIntensityZeroIntensity added type-securityA security issue needs backport to 3.9only security fixes needs backport to 3.10only security fixes needs backport to 3.11only security fixes needs backport to 3.12only security fixes needs backport to 3.13bugs and security fixes needs backport to 3.14bugs and security fixes labelsMay 30, 2025
@serhiy-storchaka
Copy link
Member

There is other quadratic complexity here -- in the regular expression. Example:expandvars('${'*1000000).

Also, usingre.sub() is more efficient here. See#134952.

@Wulian233
Copy link
ContributorAuthor

Also, usingre.sub() is more efficient here. See#134952

#134952 include this fix. What should I do? Should I modify this PR according to your changes or close this PR👀

@serhiy-storchaka
Copy link
Member

I suggest to close this PR in favor of#134952, unless the latter has serious flaws. Thank you anyway.

@Wulian233
Copy link
ContributorAuthor

No problem

@Wulian233Wulian233 deleted the posixpath-dos branchMay 31, 2025 07:57
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
awaiting reviewneeds backport to 3.9only security fixesneeds backport to 3.10only security fixesneeds backport to 3.11only security fixesneeds backport to 3.12only security fixesneeds backport to 3.13bugs and security fixesneeds backport to 3.14bugs and security fixestype-securityA security issue
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

3 participants
@Wulian233@serhiy-storchaka@ZeroIntensity
[8]ページ先頭
©2009-2025 Movatter.jp