[GHSA-hhq3-ff78-jv3g] loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)

[NxPKG]

Updates

• Affected products
• CWEs
• Description

Comments

import re

def match_regex(regex, string, timeout=1):
  """Matches a regular expression against a string, with a timeout.

  Args:
    regex: The regular expression to match.
    string: The string to match against.
    timeout: The maximum amount of time to spend matching the regular expression.

  Returns:
    True if the regular expression matches the string, False otherwise.
  """

  regex = re.compile(regex, re.DOTALL)
  start_time = time.time()
  match = regex.match(string)
  end_time = time.time()
  if match and (end_time - start_time) <= timeout:
    return True
  else:
    return False

[shelbyc]

👋 Hi @NxPKG, thank you for your interest in GHSA-hhq3-ff78-jv3g, but we don't include general remediation advice for classes of vulnerabilities in GitHub Security Advisories unless the maintainer includes the advice in their repository advisory. Have a good week!