From 88f02bc335d5404991e532e7f3b0fc80437bf4e0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alex=20Gr=C3=B6nholm?= Date: Thu, 20 Oct 2022 17:13:23 +0300 Subject: [PATCH] Fixed potential DoS attack via WHEEL_INFO_RE --- docs/news.rst | 1 + src/wheel/wheelfile.py | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/news.rst b/docs/news.rst index d348b87e..fb5b16b2 100644 --- a/docs/news.rst +++ b/docs/news.rst @@ -9,6 +9,7 @@ Release Notes - The handling of ``license_files`` (including glob patterns and default values) is now delegated to ``setuptools>=57.0.0`` (#466). The package dependencies were updated to reflect this change. +- Fixed potential DoS attack via the ``WHEEL_INFO_RE`` regular expression **0.37.1 (2021-12-22)** diff --git a/src/wheel/wheelfile.py b/src/wheel/wheelfile.py index a0c9d2a5..b985774e 100644 --- a/src/wheel/wheelfile.py +++ b/src/wheel/wheelfile.py @@ -16,8 +16,8 @@ # Non-greedy matching of an optional build number may be too clever (more # invalid wheel filenames will match). Separate regex for .dist-info? WHEEL_INFO_RE = re.compile( - r"""^(?P(?P.+?)-(?P.+?))(-(?P\d[^-]*))? - -(?P.+?)-(?P.+?)-(?P.+?)\.whl$""", + r"""^(?P(?P[^-]+?)-(?P[^-]+?))(-(?P\d[^-]*))? + -(?P[^-]+?)-(?P[^-]+?)-(?P[^.]+?)\.whl$""", re.VERBOSE, )