Skip to content

Commit 04a3c61

Browse files
committed
Regression test for http.cookiejar REDoS
If we regress, this test will take a very long time.
1 parent 92f4602 commit 04a3c61

File tree

1 file changed

+7
-0
lines changed

1 file changed

+7
-0
lines changed

Lib/test/test_http_cookiejar.py

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,6 +123,13 @@ def test_http2time_garbage(self):
123123
"http2time(%s) is not None\n"
124124
"http2time(test) %s" % (test, http2time(test)))
125125

126+
def test_http2time_redos_regression_actually_completes(self):
127+
# LOOSE_HTTP_DATE_RE was vulnerable to malicious input which caused catastrophic backtracking (REDoS).
128+
# If we regress to cubic complexity, this test will take a very long time to succeed.
129+
# If fixed, it should complete within a fraction of a second.
130+
http2time("01 Jan 1970{}00:00:00 GMT!".format(" " * 10 ** 5))
131+
http2time("01 Jan 1970 00:00:00{}GMT!".format(" " * 10 ** 5))
132+
126133
def test_iso2time(self):
127134
def parse_date(text):
128135
return time.gmtime(iso2time(text))[:6]

0 commit comments

Comments
 (0)