From b83673f1c82f1125a4fbd6eb398ae24c50e203ba Mon Sep 17 00:00:00 2001 From: mdipierro Date: Tue, 27 Nov 2012 11:29:36 -0600 Subject: [PATCH] new router patch fixes runaway vulnerability, thanks Jonathan --- VERSION | 2 +- gluon/rewrite.py | 9 +++++++-- router.example.py | 4 ++-- 3 files changed, 10 insertions(+), 5 deletions(-) diff --git a/VERSION b/VERSION index edf1e536..4e432e06 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -Version 2.2.1 (2012-11-27 10:16:40) stable +Version 2.2.1 (2012-11-27 11:28:54) stable diff --git a/gluon/rewrite.py b/gluon/rewrite.py index 5c677970..f6eee386 100644 --- a/gluon/rewrite.py +++ b/gluon/rewrite.py @@ -75,8 +75,13 @@ def _router_default(): exclusive_domain=False, map_hyphen=False, acfe_match=r'\w+$', # legal app/ctlr/fcn/ext - file_match=r'([-+=@$%\w]+[./]?)+$', # legal static subpath - args_match=r'([\w@ -]|(?<=[\w@ -])[.=])*$', # legal arg in args + # + # Implementation note: + # The file_match & args_match patterns use look-behind to avoid + # pathological backtracking from nested patterns. + # + file_match = r'([-+=@$%\w]|(?<=[-+=@$%\w])[./])*$', # legal static subpath + args_match=r'([\w@ -]|(?<=[\w@ -])[.=])*$', # legal arg in args ) return router diff --git a/router.example.py b/router.example.py index 8822ba54..75e3af9e 100644 --- a/router.example.py +++ b/router.example.py @@ -89,8 +89,8 @@ # domains = None, # map_hyphen = False, # acfe_match = r'\w+$', # legal app/ctlr/fcn/ext -# file_match = r'([-+=@$%\w]+[./]?)+$', # legal static subpath -# args_match = r'([\w@ -]+[=.]?)+$', # legal arg in args +# file_match = r'([-+=@$%\w]|(?<=[-+=@$%\w])[./])*$', # legal static subpath +# args_match = r'([\w@ -]|(?<=[\w@ -])[.=])*$', # legal arg in args # ) # # See rewrite.map_url_in() and rewrite.map_url_out() for implementation details.