Skip to content

Commit

Permalink
Merge pull request from GHSA-wj85-w4f4-xh8h (#1350)
Browse files Browse the repository at this point in the history
* ReDos: Apply `re.escape` to unsafe variable `keyword` before passing to `re.compile`

* Replace ReDos-vulnerable regex with the one from upstream Python-Markdown

* ReDos backtracking fix for macro plugin

* Add release note for GHSA-wj85-w4f4-xh8h

* Bump release date

* Bump version
  • Loading branch information
benjaoming committed Mar 16, 2024
1 parent f7739d0 commit 8e280fd
Show file tree
Hide file tree
Showing 5 changed files with 35 additions and 10 deletions.
11 changes: 11 additions & 0 deletions docs/release_notes.rst
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,17 @@ Removed
* Removes support for Python 3.7, 3.8, 3.9


0.10.1
------

Released on 2024-03-16

Security
~~~~~~~~

* Fixes reDOS issues: Denial of Service possible through unsafe regular expressions `GHSA-wj85-w4f4-xh8h <https://github.com/django-wiki/django-wiki/security/advisories/GHSA-wj85-w4f4-xh8h>`__ (Santos Gallegos, Benjamin Balder Bach)


0.10
----

Expand Down
22 changes: 14 additions & 8 deletions src/wiki/core/markdown/mdx/codehilite.py
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
from textwrap import dedent

import logging
import re

Expand All @@ -7,6 +9,7 @@
from markdown.treeprocessors import Treeprocessor
from wiki.core.markdown import add_to_registry


logger = logging.getLogger(__name__)


Expand Down Expand Up @@ -35,14 +38,17 @@ class WikiFencedBlockPreprocessor(Preprocessor):
"""

FENCED_BLOCK_RE = re.compile(
r"""
(?P<fence>^(?:~{3,}|`{3,}))[ ]* # Opening ``` or ~~~
(\{?\.?(?P<lang>[a-zA-Z0-9_+-]*))?[ ]* # Optional {, and lang
# Optional highlight lines, single- or double-quote-delimited
(hl_lines=(?P<quot>"|')(?P<hl_lines>.*?)(?P=quot))?[ ]*
}?[ ]*\n # Optional closing }
(?P<code>.*?)(?<=\n)
(?P=fence)[ ]*$""",
dedent(
r"""
(?P<fence>^(?:~{3,}|`{3,}))[ ]* # opening fence
((\{(?P<attrs>[^\}\n]*)\})| # (optional {attrs} or
(\.?(?P<lang>[\w#.+-]*)[ ]*)? # optional (.)lang
(hl_lines=(?P<quot>"|')(?P<hl_lines>.*?)(?P=quot)[ ]*)?) # optional hl_lines)
\n # newline (end of opening fence)
(?P<code>.*?)(?<=\n) # the code block
(?P=fence)[ ]*$ # closing fence
"""
),
re.MULTILINE | re.DOTALL | re.VERBOSE,
)
CODE_WRAP = "<pre>%s</pre>"
Expand Down
8 changes: 7 additions & 1 deletion src/wiki/plugins/macros/mdx/macro.py
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,11 @@
# http://stackoverflow.com/questions/430759/regex-for-managing-escaped-characters-for-items-like-string-literals
re_sq_short = r"'([^'\\]*(?:\\.[^'\\]*)*)'"

MACRO_RE = r"(\[(?P<macro>\w+)(?P<kwargs>\s\w+\:.+)*\])"

MACRO_RE = (
r"""\[(?P<macro>\w+)(?P<kwargs>(\s+\w+\:([^\:\]\s]+|'[^']+'))+)*\]"""
)

KWARG_RE = re.compile(
r"\s*(?P<arg>\w+)(:(?P<value>([^\']+|%s)))?" % re_sq_short, re.IGNORECASE
)
Expand Down Expand Up @@ -48,10 +52,12 @@ def handleMatch(self, m):
kwargs = m.group("kwargs")
if not kwargs:
return getattr(self, macro)()

kwargs_dict = {}
for kwarg in KWARG_RE.finditer(kwargs):
arg = kwarg.group("arg")
value = kwarg.group("value")

if value is None:
value = True
if isinstance(value, str):
Expand Down
2 changes: 1 addition & 1 deletion src/wiki/templatetags/wiki_tags.py
Original file line number Diff line number Diff line change
Expand Up @@ -129,7 +129,7 @@ def clean_text(content):
before = " ".join(before_words)
after = " ".join(after_words)
html = ("%s %s %s" % (before, striptags(match), after)).strip()
kw_p = re.compile(r"(\S*%s\S*)" % keyword, re.IGNORECASE)
kw_p = re.compile(r"(\S*%s\S*)" % re.escape(keyword), re.IGNORECASE)
html = kw_p.sub(r"<strong>\1</strong>", html)

return mark_safe(html)
Expand Down
2 changes: 2 additions & 0 deletions tests/plugins/macros/test_toc.py
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@


class TocMacroTests(TestCase):
maxDiff = None

def test_toc_renders_table_of_content(self):
"""Verifies that the [TOC] wiki code renders a Table of Content"""
md = Markdown(extensions=["extra", WikiTocExtension()])
Expand Down

0 comments on commit 8e280fd

Please sign in to comment.