search

tornadoweb / tornado

Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed.
http://www.tornadoweb.org/
Apache License 2.0
21.77k stars 5.51k forks source link

httputil: Fix quadratic performance of cookie parsing #3447

Open bdarnell opened 4 days ago

bdarnell commented 4 days ago

Maliciously-crafted cookies can cause Tornado to spend an unreasonable amount of CPU time and block the event loop.

This change replaces the quadratic algorithm with a more efficient one. The implementation is copied from the Python 3.13 standard library (the previous one was from Python 3.5).

Fixes CVE-2024-52804 See CVE-2024-7592 for a similar vulnerability in cpython.

Thanks to github.com/kexinoh for the report.

This is the master-branch version of #3446