search

SecurityInnovation / PGPy

Pretty Good Privacy for Python
BSD 3-Clause "New" or "Revised" License
313 stars 98 forks source link

Armor regex catastrophic backtracking problem #466

Open bwbroersma opened 2 months ago

bwbroersma commented 2 months ago

The armor regex: https://github.com/SecurityInnovation/PGPy/blob/30a757181ab02f918a94f8549f354d93639b95e6/pgpy/types.py#L49-L69 has catastrophic backtracking problems.

See this example on regex101.com, which results in:

Catastrophic backtracking has been detected and the execution of your expression has been halted. To find out more and what this is, please read the following article: Runaway Regular Expressions

The problem are the six dashes (while only 5 are valid PGP):

------BEGIN PGP SIGNATURE-----
------END PGP SIGNATURE-----

which does not match, and because of some nested * capture, there is a backtracking chaos.

After some tweaking I've a regex patch that has the same py39 outcome: