Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

second lexer reg memory use issue #367

Closed
zzzeek opened this issue Sep 22, 2022 · 1 comment
Closed

second lexer reg memory use issue #367

zzzeek opened this issue Sep 22, 2022 · 1 comment
Labels
bug Something isn't working lexer

Comments

@zzzeek
Copy link
Member

zzzeek commented Sep 22, 2022 

>>> from mako.lexer import Lexer
>>> template = '<%def name="foo()"> this is a def. </%' + ' ' * 10000
>>> Lexer(template).parse()
@zzzeek zzzeek added bug Something isn't working lexer labels Sep 22, 2022
@sqla-tester
Copy link
Collaborator

Mike Bayer has proposed a fix for this issue in the main branch:

replace "dot" with "set not containing whitespace" https://gerrit.sqlalchemy.org/c/sqlalchemy/mako/+/4091

rpurdie pushed a commit to yoctoproject/poky that referenced this issue Nov 1, 2022
@moto-timo @rpurdie
python3-mako: upgrade 1.2.2 -> 1.2.3
280a1f5 
Released: Thu Sep 22 2022
* bug

 - [bug] [lexer]

   * Fixed issue in lexer in the same category as that of #366 where the regexp
     used to match an end tag didn’t correctly organize for matching characters
     surrounded by whitespace, leading to high memory / interpreter hang if a
     closing tag incorrectly had a large amount of unterminated space in it.
     Credit to Sebastian Chnelik for locating the issue.

    As Mako templates inherently render and directly invoke arbitrary Python
    code from the template source, it is never appropriate to create templates
    that contain untrusted input.

    References: #367

[1] https://docs.makotemplates.org/en/latest/changelog.html#change-1.2.3
[2] sqlalchemy/mako#366
[3] sqlalchemy/mako#367

(From OE-Core rev: c927983ba7af9895e550018476759dd12fa90452)

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
halstead pushed a commit to openembedded/openembedded-core that referenced this issue Nov 1, 2022
@moto-timo @rpurdie
python3-mako: upgrade 1.2.2 -> 1.2.3
c927983 
Released: Thu Sep 22 2022
* bug

 - [bug] [lexer]

   * Fixed issue in lexer in the same category as that of #366 where the regexp
     used to match an end tag didn’t correctly organize for matching characters
     surrounded by whitespace, leading to high memory / interpreter hang if a
     closing tag incorrectly had a large amount of unterminated space in it.
     Credit to Sebastian Chnelik for locating the issue.

    As Mako templates inherently render and directly invoke arbitrary Python
    code from the template source, it is never appropriate to create templates
    that contain untrusted input.

    References: #367

[1] https://docs.makotemplates.org/en/latest/changelog.html#change-1.2.3
[2] sqlalchemy/mako#366
[3] sqlalchemy/mako#367

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
rpurdie pushed a commit to yoctoproject/poky that referenced this issue Nov 1, 2022
@moto-timo @rpurdie
python3-mako: upgrade 1.2.2 -> 1.2.3
025baf7 
Released: Thu Sep 22 2022
* bug

 - [bug] [lexer]

   * Fixed issue in lexer in the same category as that of #366 where the regexp
     used to match an end tag didn’t correctly organize for matching characters
     surrounded by whitespace, leading to high memory / interpreter hang if a
     closing tag incorrectly had a large amount of unterminated space in it.
     Credit to Sebastian Chnelik for locating the issue.

    As Mako templates inherently render and directly invoke arbitrary Python
    code from the template source, it is never appropriate to create templates
    that contain untrusted input.

    References: #367

[1] https://docs.makotemplates.org/en/latest/changelog.html#change-1.2.3
[2] sqlalchemy/mako#366
[3] sqlalchemy/mako#367

(From OE-Core rev: 6e1c50a131429cb5cc7b86ea5765c85850f97446)

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
halstead pushed a commit to openembedded/openembedded-core that referenced this issue Nov 1, 2022
@moto-timo @rpurdie
python3-mako: upgrade 1.2.2 -> 1.2.3
6e1c50a 
Released: Thu Sep 22 2022
* bug

 - [bug] [lexer]

   * Fixed issue in lexer in the same category as that of #366 where the regexp
     used to match an end tag didn’t correctly organize for matching characters
     surrounded by whitespace, leading to high memory / interpreter hang if a
     closing tag incorrectly had a large amount of unterminated space in it.
     Credit to Sebastian Chnelik for locating the issue.

    As Mako templates inherently render and directly invoke arbitrary Python
    code from the template source, it is never appropriate to create templates
    that contain untrusted input.

    References: #367

[1] https://docs.makotemplates.org/en/latest/changelog.html#change-1.2.3
[2] sqlalchemy/mako#366
[3] sqlalchemy/mako#367

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
rpurdie pushed a commit to yoctoproject/poky that referenced this issue Nov 2, 2022
@moto-timo @rpurdie
python3-mako: upgrade 1.2.2 -> 1.2.3
0a97cbb 
Released: Thu Sep 22 2022
* bug

 - [bug] [lexer]

   * Fixed issue in lexer in the same category as that of #366 where the regexp
     used to match an end tag didn’t correctly organize for matching characters
     surrounded by whitespace, leading to high memory / interpreter hang if a
     closing tag incorrectly had a large amount of unterminated space in it.
     Credit to Sebastian Chnelik for locating the issue.

    As Mako templates inherently render and directly invoke arbitrary Python
    code from the template source, it is never appropriate to create templates
    that contain untrusted input.

    References: #367

[1] https://docs.makotemplates.org/en/latest/changelog.html#change-1.2.3
[2] sqlalchemy/mako#366
[3] sqlalchemy/mako#367

(From OE-Core rev: 49ad6f031458e1f48f24547dc88e41abc4ec41a6)

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
halstead pushed a commit to openembedded/openembedded-core that referenced this issue Nov 2, 2022
@moto-timo @rpurdie
python3-mako: upgrade 1.2.2 -> 1.2.3
49ad6f0 
Released: Thu Sep 22 2022
* bug

 - [bug] [lexer]

   * Fixed issue in lexer in the same category as that of #366 where the regexp
     used to match an end tag didn’t correctly organize for matching characters
     surrounded by whitespace, leading to high memory / interpreter hang if a
     closing tag incorrectly had a large amount of unterminated space in it.
     Credit to Sebastian Chnelik for locating the issue.

    As Mako templates inherently render and directly invoke arbitrary Python
    code from the template source, it is never appropriate to create templates
    that contain untrusted input.

    References: #367

[1] https://docs.makotemplates.org/en/latest/changelog.html#change-1.2.3
[2] sqlalchemy/mako#366
[3] sqlalchemy/mako#367

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
kraj pushed a commit to YoeDistro/poky that referenced this issue Nov 2, 2022
@moto-timo @alexandrebelloni
python3-mako: upgrade 1.2.2 -> 1.2.3
4b1567c 
Released: Thu Sep 22 2022
* bug

 - [bug] [lexer]

   * Fixed issue in lexer in the same category as that of #366 where the regexp
     used to match an end tag didn’t correctly organize for matching characters
     surrounded by whitespace, leading to high memory / interpreter hang if a
     closing tag incorrectly had a large amount of unterminated space in it.
     Credit to Sebastian Chnelik for locating the issue.

    As Mako templates inherently render and directly invoke arbitrary Python
    code from the template source, it is never appropriate to create templates
    that contain untrusted input.

    References: #367

[1] https://docs.makotemplates.org/en/latest/changelog.html#change-1.2.3
[2] sqlalchemy/mako#366
[3] sqlalchemy/mako#367

(From OE-Core rev: a32dae12a9beeb5e9d74cd07f8595d0a4bda1850)

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
halstead pushed a commit to openembedded/openembedded-core that referenced this issue Nov 24, 2022
@moto-timo @sakoman
python3-mako: upgrade 1.2.2 -> 1.2.3
ce8d8fb 
Released: Thu Sep 22 2022
* bug

 - [bug] [lexer]

   * Fixed issue in lexer in the same category as that of #366 where the regexp
     used to match an end tag didn’t correctly organize for matching characters
     surrounded by whitespace, leading to high memory / interpreter hang if a
     closing tag incorrectly had a large amount of unterminated space in it.
     Credit to Sebastian Chnelik for locating the issue.

    As Mako templates inherently render and directly invoke arbitrary Python
    code from the template source, it is never appropriate to create templates
    that contain untrusted input.

    References: #367

[1] https://docs.makotemplates.org/en/latest/changelog.html#change-1.2.3
[2] sqlalchemy/mako#366
[3] sqlalchemy/mako#367

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 49ad6f0)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working lexer
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@zzzeek @sqla-tester