openstack/taskflow
Code Issues Proposed changes

Prevent potential ReDoS attack

Browse Source 
Although the logic is used to parse a config value, it'd be better to
eliminate a risk.

Change-Id: Id30a69071ef9c3877f3153b95ee2d00d08c17921
This commit is contained in:
Takashi Kajinami 2024-02-13 09:39:38 +09:00
parent fe74dae2fe
commit b389cb5e93
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
taskflow/jobs/backends/impl_redis.py
View File

@ -562,11 +562,11 @@ return cmsgpack.pack(result)
@classmethod
def _parse_sentinel(cls, sentinel):
# IPv6 (eg. [::1]:6379 )
match = re.search(r'\[(\S+)\]:(\d+)', sentinel)
match = re.search(r'^\[(\S+)\]:(\d+)$', sentinel)
if match:
return (match[1], int(match[2]))
# IPv4 or hostname (eg. 127.0.0.1:6379 or localhost:6379)
match = re.search(r'(\S+):(\d+)', sentinel)
match = re.search(r'^(\S+):(\d+)$', sentinel)
if match:
return (match[1], int(match[2]))
raise ValueError('Malformed sentinel server format')