mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-01-13 03:41:43 +00:00
420acd8735
sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This issue was introduced by commit `e75e358`. The vulnerability may lead to Denial of Service (DoS). This issues has been fixed in sqlparse 0.4.4 by commit `c457abd5f`. Users are advised to upgrade. There are no known workarounds for this issue. Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
76 lines
2.6 KiB
Diff
76 lines
2.6 KiB
Diff
From fa1cc25e1967228e5d47b9ddb626cc82dba92d7e Mon Sep 17 00:00:00 2001
|
|
From: Andi Albrecht <albrecht.andi@gmail.com>
|
|
Date: Wed, 31 May 2023 12:29:07 +0000
|
|
Subject: [PATCH] Remove unnecessary parts in regex for bad escaping.
|
|
|
|
The regex tried to deal with situations where escaping in the
|
|
SQL to be parsed was suspicious.
|
|
|
|
CVE: CVE-2023-30608
|
|
|
|
Upstream-Status: Backport [https://github.com/andialbrecht/sqlparse/commit/c457abd5f097dd13fb21543381e7cfafe7d31cfb]
|
|
|
|
Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
|
|
---
|
|
CHANGELOG | 15 +++++++++++++++
|
|
sqlparse/keywords.py | 4 ++--
|
|
tests/test_split.py | 4 ++--
|
|
3 files changed, 19 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/CHANGELOG b/CHANGELOG
|
|
index 65e03fc..a584003 100644
|
|
--- a/CHANGELOG
|
|
+++ b/CHANGELOG
|
|
@@ -1,3 +1,18 @@
|
|
+Backport CVE-2023-30608 Fix
|
|
+---------------------------
|
|
+
|
|
+Notable Changes
|
|
+
|
|
+* IMPORTANT: This release fixes a security vulnerability in the
|
|
+ parser where a regular expression vulnerable to ReDOS (Regular
|
|
+ Expression Denial of Service) was used. See the security advisory
|
|
+ for details: https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2
|
|
+ The vulnerability was discovered by @erik-krogh from GitHub
|
|
+ Security Lab (GHSL). Thanks for reporting!
|
|
+
|
|
+* Fix regular expressions for string parsing.
|
|
+
|
|
+
|
|
Release 0.4.2 (Sep 10, 2021)
|
|
----------------------------
|
|
|
|
diff --git a/sqlparse/keywords.py b/sqlparse/keywords.py
|
|
index 6850628..4e97477 100644
|
|
--- a/sqlparse/keywords.py
|
|
+++ b/sqlparse/keywords.py
|
|
@@ -66,9 +66,9 @@ SQL_REGEX = {
|
|
(r'(?![_A-ZÀ-Ü])-?(\d+(\.\d*)|\.\d+)(?![_A-ZÀ-Ü])',
|
|
tokens.Number.Float),
|
|
(r'(?![_A-ZÀ-Ü])-?\d+(?![_A-ZÀ-Ü])', tokens.Number.Integer),
|
|
- (r"'(''|\\\\|\\'|[^'])*'", tokens.String.Single),
|
|
+ (r"'(''|\\'|[^'])*'", tokens.String.Single),
|
|
# not a real string literal in ANSI SQL:
|
|
- (r'"(""|\\\\|\\"|[^"])*"', tokens.String.Symbol),
|
|
+ (r'"(""|\\"|[^"])*"', tokens.String.Symbol),
|
|
(r'(""|".*?[^\\]")', tokens.String.Symbol),
|
|
# sqlite names can be escaped with [square brackets]. left bracket
|
|
# cannot be preceded by word character or a right bracket --
|
|
diff --git a/tests/test_split.py b/tests/test_split.py
|
|
index a9d7576..e79750e 100644
|
|
--- a/tests/test_split.py
|
|
+++ b/tests/test_split.py
|
|
@@ -18,8 +18,8 @@ def test_split_semicolon():
|
|
|
|
|
|
def test_split_backslash():
|
|
- stmts = sqlparse.parse(r"select '\\'; select '\''; select '\\\'';")
|
|
- assert len(stmts) == 3
|
|
+ stmts = sqlparse.parse("select '\'; select '\'';")
|
|
+ assert len(stmts) == 2
|
|
|
|
|
|
@pytest.mark.parametrize('fn', ['function.sql',
|
|
--
|
|
2.40.0
|