Skip to content

Commit

Permalink
Fix ReDOS vulnerability
Browse files Browse the repository at this point in the history
Fixes #548, with the workaround suggested by @yetingli.
  • Loading branch information
vks committed Feb 10, 2021
1 parent c6a35f9 commit c811b37
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 2 deletions.
4 changes: 2 additions & 2 deletions mpmath/ctx_mp.py
Expand Up @@ -42,8 +42,8 @@

new = object.__new__

get_complex = re.compile(r'^\(?(?P<re>[\+\-]?\d*\.?\d*(e[\+\-]?\d+)?)??'
r'(?P<im>[\+\-]?\d*\.?\d*(e[\+\-]?\d+)?j)?\)?$')
get_complex = re.compile(r'^\(?(?P<re>[\+\-]?\d*(\.\d*)?(e[\+\-]?\d+)?)??'
r'(?P<im>[\+\-]?\d*(\.\d*)?(e[\+\-]?\d+)?j)?\)?$')

if BACKEND == 'sage':
from sage.libs.mpmath.ext_main import Context as BaseMPContext
Expand Down
10 changes: 10 additions & 0 deletions mpmath/tests/test_convert.py
Expand Up @@ -194,6 +194,16 @@ def test_mpmathify():
assert mpmathify('(1.2e-10 - 3.4e5j)') == mpc('1.2e-10', '-3.4e5')
assert mpmathify('1j') == mpc(1j)

def test_issue548():
try:
# This expression is invalid, but may trigger the ReDOS vulnerability
# in the regular expression.
mpmathify('(' + '1' * 5000 + '!j')
except:
return
# The expression is invalid and should raise an exception.
assert False

def test_compatibility():
try:
import numpy as np
Expand Down

0 comments on commit c811b37

Please sign in to comment.