python-rpm-spec
python-rpm-spec copied to clipboard
Avoid DoS on carefully crafted spec files (fix #61)
Fixes #61 by using a maximum number of attempts while replacing macros recursively.
Added the missing newline so the linter doesn't complain.
Hey. Thanks for the PR. Is there a reason for max_attempts being 1000? And why make it an argument at all?
Is it OK with you guys if we make max_attempts local to that function?
Is it OK with you guys if we make max_attempts local to that function?
I left the max_attempts as a param to keep compatibility and/or let the user to call that function to whatever value seems/works appropriate for them
The use of 1000 is just an arbitrary number, we can set it to any value that is high enough so the while loop ends.
Finally @bkircher. maybe it's better to just throw an exception instead of returning when that max_attempts is reached. To me, as far as the loop exits in some way is an acceptable solution instead of looping forever.
Just let me know what you want and I'll update the PR.
I left the max_attempts as a param to keep compatibility and/or let the user to call that function to whatever value seems/works appropriate for them
OK for me.
The use of 1000 is just an arbitrary number, we can set it to any value that is high enough so the while loop ends.
OK.
Finally @bkircher. maybe it's better to just throw an exception instead of returning when that max_attempts is reached. To me, as far as the loop exits in some way is an acceptable solution instead of looping forever.
Good one. I cherry-picked this into cfbde15 and added a subsequent commit that raises a RuntimeError instead of returning from that function.