-
-
Notifications
You must be signed in to change notification settings - Fork 8
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Latest data: Fri Oct 25 08:05:08 UTC 2024
- Loading branch information
github.actions
committed
Oct 25, 2024
1 parent
e025fed
commit 5fcefcf
Showing
6 changed files
with
172 additions
and
31 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,142 @@ | ||
| [ | ||
| { | ||
| "package": { | ||
| "name": "sqlparse", | ||
| "version": "0.4.4", | ||
| "ecosystem": "PyPI" | ||
| }, | ||
| "dependency_groups": [ | ||
| "dolphie-requirements" | ||
| ], | ||
| "vulnerabilities": [ | ||
| { | ||
| "modified": "2024-05-01T11:15:56Z", | ||
| "published": "2024-04-15T20:21:25Z", | ||
| "schema_version": "1.6.0", | ||
| "id": "GHSA-2m57-hf25-phgg", | ||
| "aliases": [ | ||
| "CVE-2024-4340" | ||
| ], | ||
| "related": [ | ||
| "CGA-p7rq-qffc-ch9v", | ||
| "CGA-v3hx-x533-rpgf" | ||
| ], | ||
| "summary": "sqlparse parsing heavily nested list leads to Denial of Service", | ||
| "details": "### Summary\nPassing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.\n\n### Details + PoC\nRunning the following code will raise Maximum recursion limit exceeded exception:\n```py\nimport sqlparse\nsqlparse.parse('[' * 10000 + ']' * 10000)\n```\nWe expect a traceback of RecursionError:\n```py\nTraceback (most recent call last):\n File \"trigger_sqlparse_nested_list.py\", line 3, in <module>\n sqlparse.parse('[' * 10000 + ']' * 10000)\n File \"/home/uriya/.local/lib/python3.10/site-packages/sqlparse/__init__.py\", line 30, in parse\n return tuple(parsestream(sql, encoding))\n File \"/home/uriya/.local/lib/python3.10/site-packages/sqlparse/engine/filter_stack.py\", line 36, in run\n stmt = grouping.group(stmt)\n File \"/home/uriya/.local/lib/python3.10/site-packages/sqlparse/engine/grouping.py\", line 428, in group\n func(stmt)\n File \"/home/uriya/.local/lib/python3.10/site-packages/sqlparse/engine/grouping.py\", line 53, in group_brackets\n _group_matching(tlist, sql.SquareBrackets)\n File \"/home/uriya/.local/lib/python3.10/site-packages/sqlparse/engine/grouping.py\", line 48, in _group_matching\n tlist.group_tokens(cls, open_idx, close_idx)\n File \"/home/uriya/.local/lib/python3.10/site-packages/sqlparse/sql.py\", line 328, in group_tokens\n grp = grp_cls(subtokens)\n File \"/home/uriya/.local/lib/python3.10/site-packages/sqlparse/sql.py\", line 161, in __init__\n super().__init__(None, str(self))\n File \"/home/uriya/.local/lib/python3.10/site-packages/sqlparse/sql.py\", line 165, in __str__\n return ''.join(token.value for token in self.flatten())\n File \"/home/uriya/.local/lib/python3.10/site-packages/sqlparse/sql.py\", line 165, in <genexpr>\n return ''.join(token.value for token in self.flatten())\n File \"/home/uriya/.local/lib/python3.10/site-packages/sqlparse/sql.py\", line 214, in flatten\n yield from token.flatten()\n File \"/home/uriya/.local/lib/python3.10/site-packages/sqlparse/sql.py\", line 214, in flatten\n yield from token.flatten()\n File \"/home/uriya/.local/lib/python3.10/site-packages/sqlparse/sql.py\", line 214, in flatten\n yield from token.flatten()\n [Previous line repeated 983 more times]\nRecursionError: maximum recursion depth exceeded\n```\n\n### Fix suggestion\nThe [flatten()](https://github.com/andialbrecht/sqlparse/blob/master/sqlparse/sql.py#L207) function of TokenList class should limit the recursion to a maximal depth:\n```py\nfrom sqlparse.exceptions import SQLParseError\n\nMAX_DEPTH = 100\n\n def flatten(self, depth=1):\n \"\"\"Generator yielding ungrouped tokens.\n\n This method is recursively called for all child tokens.\n \"\"\"\n if depth >= MAX_DEPTH:\n raise SQLParseError('Maximal depth reached')\n for token in self.tokens:\n if token.is_group:\n yield from token.flatten(depth + 1)\n else:\n yield token\n```\n\n### Impact\nDenial of Service (the impact depends on the use).\nAnyone parsing a user input with sqlparse.parse() is affected.\n", | ||
| "affected": [ | ||
| { | ||
| "package": { | ||
| "ecosystem": "PyPI", | ||
| "name": "sqlparse", | ||
| "purl": "pkg:pypi/sqlparse" | ||
| }, | ||
| "ranges": [ | ||
| { | ||
| "type": "ECOSYSTEM", | ||
| "events": [ | ||
| { | ||
| "introduced": "0" | ||
| }, | ||
| { | ||
| "fixed": "0.5.0" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "versions": [ | ||
| "0.1.0", | ||
| "0.1.1", | ||
| "0.1.10", | ||
| "0.1.11", | ||
| "0.1.12", | ||
| "0.1.13", | ||
| "0.1.14", | ||
| "0.1.15", | ||
| "0.1.16", | ||
| "0.1.17", | ||
| "0.1.18", | ||
| "0.1.19", | ||
| "0.1.2", | ||
| "0.1.3", | ||
| "0.1.4", | ||
| "0.1.5", | ||
| "0.1.6", | ||
| "0.1.7", | ||
| "0.1.8", | ||
| "0.1.9", | ||
| "0.2.0", | ||
| "0.2.1", | ||
| "0.2.2", | ||
| "0.2.3", | ||
| "0.2.4", | ||
| "0.3.0", | ||
| "0.3.1", | ||
| "0.4.0", | ||
| "0.4.1", | ||
| "0.4.2", | ||
| "0.4.3", | ||
| "0.4.4" | ||
| ], | ||
| "database_specific": { | ||
| "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-2m57-hf25-phgg/GHSA-2m57-hf25-phgg.json" | ||
| }, | ||
| "ecosystem_specific": { | ||
| "affected_functions": [ | ||
| "sqlparse.parse" | ||
| ] | ||
| } | ||
| } | ||
| ], | ||
| "severity": [ | ||
| { | ||
| "type": "CVSS_V3", | ||
| "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" | ||
| } | ||
| ], | ||
| "references": [ | ||
| { | ||
| "type": "WEB", | ||
| "url": "https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-2m57-hf25-phgg" | ||
| }, | ||
| { | ||
| "type": "ADVISORY", | ||
| "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4340" | ||
| }, | ||
| { | ||
| "type": "WEB", | ||
| "url": "https://github.com/andialbrecht/sqlparse/commit/b4a39d9850969b4e1d6940d32094ee0b42a2cf03" | ||
| }, | ||
| { | ||
| "type": "PACKAGE", | ||
| "url": "https://github.com/andialbrecht/sqlparse" | ||
| }, | ||
| { | ||
| "type": "WEB", | ||
| "url": "https://research.jfrog.com/vulnerabilities/sqlparse-stack-exhaustion-dos-jfsa-2024-001031292" | ||
| } | ||
| ], | ||
| "database_specific": { | ||
| "cwe_ids": [ | ||
| "CWE-674" | ||
| ], | ||
| "github_reviewed": true, | ||
| "github_reviewed_at": "2024-04-15T20:21:25Z", | ||
| "nvd_published_at": null, | ||
| "severity": "HIGH" | ||
| } | ||
| } | ||
| ], | ||
| "groups": [ | ||
| { | ||
| "ids": [ | ||
| "GHSA-2m57-hf25-phgg" | ||
| ], | ||
| "aliases": [ | ||
| "CVE-2024-4340", | ||
| "GHSA-2m57-hf25-phgg" | ||
| ], | ||
| "max_severity": "7.5" | ||
| } | ||
| ] | ||
| } | ||
| ] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,11 +1,11 @@ | ||
| contourpy==1.2.1 | ||
| contourpy==1.3.0 | ||
| cycler==0.12.1 | ||
| fonttools==4.53.1 | ||
| kiwisolver==1.4.5 | ||
| matplotlib==3.9.1.post1 | ||
| fonttools==4.54.1 | ||
| kiwisolver==1.4.7 | ||
| matplotlib==3.9.2 | ||
| packaging==24.1 | ||
| pyparsing==3.1.2 | ||
| pyparsing==3.2.0 | ||
| python-dateutil==2.9.0.post0 | ||
| setuptools==72.1.0 | ||
| setuptools==75.2.0 | ||
| six==1.16.0 | ||
| zstandard==0.23.0 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters