python-rpm-spec icon indicating copy to clipboard operation
python-rpm-spec copied to clipboard

Avoid DoS on carefully crafted spec files (fix #61)

Open kraptor opened this issue 1 year ago • 4 comments

Fixes #61 by using a maximum number of attempts while replacing macros recursively.

kraptor avatar Sep 12 '23 18:09 kraptor

Added the missing newline so the linter doesn't complain.

kraptor avatar Sep 18 '23 07:09 kraptor

Hey. Thanks for the PR. Is there a reason for max_attempts being 1000? And why make it an argument at all?

bkircher avatar Sep 21 '23 17:09 bkircher

Is it OK with you guys if we make max_attempts local to that function?

bkircher avatar Sep 24 '23 17:09 bkircher

Is it OK with you guys if we make max_attempts local to that function?

I left the max_attempts as a param to keep compatibility and/or let the user to call that function to whatever value seems/works appropriate for them

The use of 1000 is just an arbitrary number, we can set it to any value that is high enough so the while loop ends.

Finally @bkircher. maybe it's better to just throw an exception instead of returning when that max_attempts is reached. To me, as far as the loop exits in some way is an acceptable solution instead of looping forever.

Just let me know what you want and I'll update the PR.

kraptor avatar Sep 25 '23 08:09 kraptor

I left the max_attempts as a param to keep compatibility and/or let the user to call that function to whatever value seems/works appropriate for them

OK for me.

The use of 1000 is just an arbitrary number, we can set it to any value that is high enough so the while loop ends.

OK.

Finally @bkircher. maybe it's better to just throw an exception instead of returning when that max_attempts is reached. To me, as far as the loop exits in some way is an acceptable solution instead of looping forever.

Good one. I cherry-picked this into cfbde15 and added a subsequent commit that raises a RuntimeError instead of returning from that function.

bkircher avatar Feb 17 '24 10:02 bkircher