Catastrophic backtracking on SQL/SQL+Jinja Lexer

[SCH227]

The following pattern is inefficient, it may lead to a Regular expression Denial of Service vulnerability:
r'\{%-?\s*macro \w+\(.*\)\s*-?%\}\s+.*\s+\{%-?\s*endmacro\s*-?%\}'
https://github.com/pygments/pygments/blob/master/pygments/lexers/templates.py#L2295

This was originally reported privately on the security channel, but was asked to open an issue here

[jeanas]

I'm not sure what you mean by “security channel”, but if you rely on Pygments terminating in reasonable time, don't. Please read https://pygments.org/docs/security/

That said, this indeed look like a bug.

[SCH227]

By "Security Channel", I meant I reported this privately to Red Hat (which I was informed is the CNA for this project) and also to one of the maintainers (georg@python.org). I preferred to not include the PoC here in public.

I have a new similar one to report. Should I open another issue here?

[jeanas]

I preferred to not include the PoC here in public.

For one thing, it's quite trivial to construct one from the issue description, and for another, Pygments does not make security guarantees, so this is not a security issue. If it can be used for RE DOS, that's a bug in the application that uses Pygments. If @birkenfeld (i.e. the person behind georg@python.org) replied, I'm sure he told you the same thing.

Should I open another issue here?

Yes, please.

[SCH227]

For one thing, it's quite trivial to construct one from the issue description

It is waay more trivial to copy and paste it.

Pygments does not make security guarantees, so this is not a security issue. If it can be used for RE DOS, that's a bug in the application that uses Pygments.

I understand, my aim is not to bother with which should be the most accurate tag for these kind of bugs or to discuss who should tackle it first. You project is great, and I am very grateful you are maintaining it.
I just want to contribute to make it better, and at the same time warn users of behaviors that may affect them negatively (besides not reading the docs xD). I understand that's the reason why CVE-2021-20270 and CVE-2021-27291 were issued in the past.

Thank you! Let me know if I can be of help issuing a patch and/or testing

[jeanas]

Should be better with 97eb3d5. Please confirm.

[SCH227]

LGTM!