Skip to content

Commit 11ca014

Browse files
committed
fix http.cookies: replace potentially backtracking regex with linear-time pattern to prevent ReDoS (closes gh-149028)
1 parent 0c1a250 commit 11ca014

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

Lib/http/cookies.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -462,7 +462,7 @@ def OutputString(self, attrs=None):
462462
( # Optional group: there may not be a value.
463463
\s*=\s* # Equal Sign
464464
(?P<val> # Start of group 'val'
465-
"(?:\\"|.)*?" # Any double-quoted string
465+
[^"\\]+ # Any unquoted string (avoid
466466
| # or
467467
# Special case for "expires" attr
468468
(\w{3,6}day|\w{3}),\s # Day of the week or abbreviated day

0 commit comments

Comments
 (0)