new router patch fixes runaway vulnerability, thanks Jonathan

2012-11-27 11:29:36 -06:00
parent ba21ce887a
commit b83673f1c8
3 changed files with 10 additions and 5 deletions
@@ -75,8 +75,13 @@ def _router_default():
        exclusive_domain=False,
        map_hyphen=False,
        acfe_match=r'\w+$',                   # legal app/ctlr/fcn/ext
-        file_match=r'([-+=@$%\w]+[./]?)+$',   # legal static subpath
-        args_match=r'([\w@ -]|(?<=[\w@ -])[.=])*$', # legal arg in args
+        #
+        #  Implementation note:
+        #  The file_match & args_match patterns use look-behind to avoid
+        #  pathological backtracking from nested patterns.
+        #
+        file_match = r'([-+=@$%\w]|(?<=[-+=@$%\w])[./])*$', # legal static subpath
+        args_match=r'([\w@ -]|(?<=[\w@ -])[.=])*$',         # legal arg in args
    )
    return router