Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

gh-121285: Remove backtracking when parsing tarfile headers #121286

Merged
merged 11 commits into from
Aug 31, 2024
Merged

gh-121285: Remove backtracking when parsing tarfile headers #121286

merged 11 commits into from
Aug 31, 2024
+112 −35

Conversation

sethmlarson
Copy link
Contributor

@sethmlarson sethmlarson commented Jul 2, 2024 •
edited by bedevere-app bot
Loading

This removes all instances of backtracking from parsing tarfile headers, specifically hdrcharset, PAX, and GNU sparse headers.

@bedevere-app bedevere-app bot mentioned this pull request Jul 2, 2024
Closed
@sethmlarson @Eclips4
Update Misc/NEWS.d/next/Security/2024-07-02-13-39-20.gh-issue-121285.…
647f4ef 
…hrl-yI.rst

Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
@sethmlarson sethmlarson requested a review from gpshead July 2, 2024 18:45
@sethmlarson sethmlarson added type-security A security issue 3.11 only security fixes 3.10 only security fixes 3.9 only security fixes 3.8 only security fixes 3.12 bugs and security fixes labels Jul 2, 2024
@hugovk
Copy link
Member

hugovk commented Jul 2, 2024

@sethmlarson Did you mean to add the "Needs backport to 3.x" labels rather than the "3.x" ones?

@sethmlarson sethmlarson added needs backport to 3.8 only security fixes needs backport to 3.9 only security fixes needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 bug and security fixes needs backport to 3.13 bugs and security fixes and removed 3.11 only security fixes 3.10 only security fixes 3.9 only security fixes 3.8 only security fixes 3.12 bugs and security fixes labels Jul 2, 2024
@sethmlarson
Copy link
Contributor Author

@hugovk Yes! Selected the wrong range of tags, my bad.

ethanfurman
ethanfurman requested changes Jul 2, 2024
View reviewed changes
Copy link
Member

@ethanfurman ethanfurman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please remove the type hints.

@bedevere-app
Copy link

bedevere-app bot commented Jul 2, 2024

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

@bedevere-app
Copy link

bedevere-app bot commented Aug 31, 2024

GH-123543 is a backport of this pull request to the 3.12 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.12 bug and security fixes label Aug 31, 2024
@miss-islington-app
Copy link

Sorry, @sethmlarson and @gpshead, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 34ddb64d088dd7ccc321f6103d23153256caa5d4 3.10

@miss-islington-app
Copy link

Sorry, @sethmlarson and @gpshead, I could not cleanly backport this to 3.9 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 34ddb64d088dd7ccc321f6103d23153256caa5d4 3.9

@miss-islington-app
Copy link

Sorry, @sethmlarson and @gpshead, I could not cleanly backport this to 3.8 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 34ddb64d088dd7ccc321f6103d23153256caa5d4 3.8

gpshead added a commit that referenced this pull request Aug 31, 2024
@miss-islington @sethmlarson
@Eclips4 @gpshead
[3.12] gh-121285: Remove backtracking when parsing tarfile headers (G…
4eaf489 
…H-121286) (GH-123543)

gh-121285: Remove backtracking when parsing tarfile headers (GH-121286)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Seth Michael Larson <seth@python.org>
Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Yhg1s pushed a commit that referenced this pull request Sep 2, 2024
@miss-islington @sethmlarson
@Eclips4 @gpshead
[3.13] gh-121285: Remove backtracking when parsing tarfile headers (G…
ed3a49e 
…H-121286) (#123542)

gh-121285: Remove backtracking when parsing tarfile headers (GH-121286)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Seth Michael Larson <seth@python.org>
Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
@sethmlarson sethmlarson deleted the remove-backtracking-tarfile-members branch September 3, 2024 12:19
sethmlarson added a commit to sethmlarson/cpython that referenced this pull request Sep 3, 2024
@sethmlarson @Eclips4 @gpshead
[3.11] pythongh-121285: Remove backtracking when parsing tarfile head…
b743113 
…ers (pythonGH-121286)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Seth Michael Larson <seth@python.org>
Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
@bedevere-app
Copy link

bedevere-app bot commented Sep 3, 2024

GH-123639 is a backport of this pull request to the 3.11 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.11 only security fixes label Sep 3, 2024
@bedevere-app
Copy link

bedevere-app bot commented Sep 3, 2024

GH-123639 is a backport of this pull request to the 3.11 branch.

sethmlarson added a commit to sethmlarson/cpython that referenced this pull request Sep 3, 2024
@sethmlarson @Eclips4 @gpshead
[3.10] pythongh-121285: Remove backtracking when parsing tarfile head…
3ea4396 
…ers (pythonGH-121286)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Seth Michael Larson <seth@python.org>
Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
@bedevere-app
Copy link

bedevere-app bot commented Sep 3, 2024

GH-123640 is a backport of this pull request to the 3.10 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.10 only security fixes label Sep 3, 2024
sethmlarson added a commit to sethmlarson/cpython that referenced this pull request Sep 3, 2024
@sethmlarson @Eclips4 @gpshead
[3.9] pythongh-121285: Remove backtracking when parsing tarfile heade…
daf223e 
…rs (pythonGH-121286)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Seth Michael Larson <seth@python.org>
Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
@bedevere-app
Copy link

bedevere-app bot commented Sep 3, 2024

GH-123641 is a backport of this pull request to the 3.9 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.9 only security fixes label Sep 3, 2024
sethmlarson added a commit to sethmlarson/cpython that referenced this pull request Sep 3, 2024
@sethmlarson @Eclips4 @gpshead
[3.8] pythongh-121285: Remove backtracking when parsing tarfile heade…
80b31d4 
…rs (pythonGH-121286)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Seth Michael Larson <seth@python.org>
Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
@bedevere-app
Copy link

bedevere-app bot commented Sep 3, 2024

GH-123642 is a backport of this pull request to the 3.8 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.8 only security fixes label Sep 3, 2024
@sethmlarson
Copy link
Contributor Author

Backports have been created.

pablogsal pushed a commit that referenced this pull request Sep 3, 2024
@sethmlarson @Eclips4 @gpshead
[3.11] gh-121285: Remove backtracking when parsing tarfile headers (G…
d449caf 
…H-121286) (#123639)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
pablogsal pushed a commit that referenced this pull request Sep 3, 2024
@sethmlarson @Eclips4 @gpshead
[3.10] gh-121285: Remove backtracking when parsing tarfile headers (G…
743acbe 
…H-121286) (#123640)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
ambv pushed a commit that referenced this pull request Sep 4, 2024
@sethmlarson @Eclips4 @gpshead
[3.8] gh-121285: Remove backtracking when parsing tarfile headers (GH…
7d1f50c 
…-121286) (#123642)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Seth Michael Larson <seth@python.org>
Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
ambv pushed a commit that referenced this pull request Sep 4, 2024
@sethmlarson @Eclips4 @gpshead
[3.9] gh-121285: Remove backtracking when parsing tarfile headers (GH…
b4225ca 
…-121286) (#123641)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Seth Michael Larson <seth@python.org>
Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
frenzymadness pushed a commit to frenzymadness/cpython that referenced this pull request Sep 5, 2024
@sethmlarson @Eclips4
@gpshead @frenzymadness
00437: [3.8] pythongh-121285: Remove backtracking when parsing tarfil…
182d6ca 
…e headers (pythonGH-121286) (python#123642)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Seth Michael Larson <seth@python.org>
Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
@frenzymadness frenzymadness mentioned this pull request Sep 5, 2024
Open
frenzymadness added a commit to frenzymadness/cpython that referenced this pull request Sep 5, 2024
@sethmlarson @Eclips4
@gpshead @frenzymadness
00437: [3.8] pythongh-121285: Remove backtracking when parsing tarfil…
3209abb 
…e headers (pythonGH-121286) (python#123642)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Seth Michael Larson <seth@python.org>
Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Co-authored-by: Lumír Balhar <lbalhar@redhat.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@personnumber3377 personnumber3377 personnumber3377 left review comments

@Eclips4 Eclips4 Eclips4 left review comments

@gpshead gpshead gpshead approved these changes

@ethanfurman ethanfurman Awaiting requested review from ethanfurman ethanfurman is a code owner

@serhiy-storchaka serhiy-storchaka Awaiting requested review from serhiy-storchaka

Assignees

@gpshead gpshead

Labels
type-security A security issue
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
7 participants
@sethmlarson @hugovk @ethanfurman @gpshead @serhiy-storchaka @personnumber3377 @Eclips4