T09 · Insecure Skill Coding Practices
Warning
- Location
- script/main.py:47
- Finding
- Unbounded User-Controlled Regular Expressions Enable Denial of Service<![CDATA[ ## Vulnerability Details **File Location**: `script/main.py:47`, `script/main.py:65`, `script/main.py:86`, `script/main.py:104`, `script/main.py:132-137` **Vulnerability Type**: Regular Expression Denial of Service (ReDoS) **Risk Level**: Medium ### Vulnerable Code ```python # match_test(), line 47 result = re.search(pattern, text, flags) # find_all(), line 65 matches = re.findall(pattern, text, flags) # find_iter(), line 86 for i, match in enumerate(re.finditer(pattern, text, flags), 1): # groups(), line 104 result = re.search(pattern, text, flags) # substitute(), lines 132-137 result = re.sub(pattern, replacement, text, count=count, flags=flags) print(f"替换后: {result}") # 显示替换次数 if count == 0: matches = re.findall(pattern, text, flags) ``` ### Technical Analysis The `pattern` and `text` arguments are obtained directly from unrestricted command-line input and passed to Python's backtracking `re` engine. No execution timeout, input-length limit, pattern-complexity restriction, or process-level resource boundary is applied. Certain expressions containing nested or ambiguous quantifiers can trigger catastrophic backtracking. For example, the pattern `(a+)+$` applied to a long string of `a` characters followed by a nonmatching character may require exponentially increasing evaluation time. The existing `except re.error` handlers only handle invalid regular-expression syntax. They do not interrupt a syntactically valid expression that consumes excessive CPU. All matching operations are affected, including search, extraction, iteration, grouping, and substitution. ### Attack Path 1. An attacker or untrusted caller invokes a command that accepts an arbitrary regular expression, such as `match`. 2. The caller supplies a backtracking-intensive pattern such as `(a+)+$`. 3. The caller supplies a sufficiently long near-matching string consisting of repeated `a` characters followed by a nonmatching character. 4. `argparse` passes both values uncha ...[truncated 818 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Execute every untrusted regular-expression operation in a separate worker process with a strict wall-clock timeout. Terminate the worker if the deadline is exceeded. 2. Do not rely solely on a thread-based timeout because a long-running native regular-expression operation may prevent timely interruption. 3. Enforce conservative maximum lengths for both patterns and input text before evaluation. 4. Consider replacing Python's backtracking engine with a linear-time regular-expression engine when the required syntax is supported. 5. Reject or warn about high-risk constructs such as nested quantifiers and ambiguous repeated groups. Treat this as defense in depth rather than a complete ReDoS detector. 6. Apply memory and CPU limits to worker processes where the operating environment supports them. 7. Return a controlled timeout error without echoing unnecessarily large attacker-provided inputs. 8. Add regression tests using known catastrophic-backtracking patterns against near-matching input to verify that execution is terminated within the configured deadline. ]]>