Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix: url validator #323

Merged
merged 6 commits into from
Feb 1, 2019
Merged

Fix: url validator #323

merged 6 commits into from
Feb 1, 2019

Conversation

digitalresistor
Copy link
Member

This fixes the URL validator issue reported in #290.

As a side note, this can lead to anyone using this validator and for example deform to be vulnerable to a Denial of Service, since it basically sends Python into an infinite loop. We should back port as necessary, and or notify this as a security issue.

Closes #290

@digitalresistor
Copy link
Member Author

I have requested a CVE for this vulnerability as a potential Denial of Service, will update CHANGES.rst and this ticket if it gets assigned.

@digitalresistor
Copy link
Member Author

This has been assigned CVE-ID: CVE-2017-18361

@digitalresistor digitalresistor self-assigned this Feb 1, 2019
@mmerickel mmerickel merged commit 9880555 into master Feb 1, 2019
@mmerickel mmerickel deleted the fix/url-validator-dos branch February 1, 2019 18:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Unclosed parenthesis in URL causes infinite loop
2 participants