diff --git a/Lib/configparser.py b/Lib/configparser.py index d435a5c2fe0da2..e76647d339e913 100644 --- a/Lib/configparser.py +++ b/Lib/configparser.py @@ -613,7 +613,9 @@ class RawConfigParser(MutableMapping): \] # ] """ _OPT_TMPL = r""" - (?P.*?) # very permissive! + (?P # very permissive! + (?:(?!{delim})\S)* # non-delimiter non-whitespace + (?:\s+(?:(?!{delim})\S)+)*) # optionally more words \s*(?P{delim})\s* # any number of space/tab, # followed by any of the # allowed delimiters, @@ -621,7 +623,9 @@ class RawConfigParser(MutableMapping): (?P.*)$ # everything up to eol """ _OPT_NV_TMPL = r""" - (?P.*?) # very permissive! + (?P # very permissive! + (?:(?!{delim})\S)* # non-delimiter non-whitespace + (?:\s+(?:(?!{delim})\S)+)*) # optionally more words \s*(?: # any number of space/tab, (?P{delim})\s* # optionally followed by # any of the allowed diff --git a/Lib/test/test_configparser.py b/Lib/test/test_configparser.py index 1bfb53ccbb1398..d7c4f19c1a5ef0 100644 --- a/Lib/test/test_configparser.py +++ b/Lib/test/test_configparser.py @@ -2270,6 +2270,26 @@ def test_section_bracket_in_key(self): output.close() +class ReDoSTestCase(unittest.TestCase): + """Regression tests for quadratic regex backtracking (gh-146333).""" + + def test_option_regex_does_not_backtrack(self): + # A line with many spaces between non-delimiter characters + # should be parsed in linear time, not quadratic. + parser = configparser.RawConfigParser() + content = "[section]\n" + "x" + " " * 40000 + "y" + "\n" + # This should complete almost instantly. Before the fix, + # it would take over a minute due to catastrophic backtracking. + with self.assertRaises(configparser.ParsingError): + parser.read_string(content) + + def test_option_regex_no_value_does_not_backtrack(self): + parser = configparser.RawConfigParser(allow_no_value=True) + content = "[section]\n" + "x" + " " * 40000 + "y" + "\n" + parser.read_string(content) + self.assertTrue(parser.has_option("section", "x" + " " * 40000 + "y")) + + class MiscTestCase(unittest.TestCase): def test__all__(self): support.check__all__(self, configparser, not_exported={"Error"}) diff --git a/Misc/NEWS.d/next/Security/2026-03-25-00-51-03.gh-issue-146333.LqdL__bn.rst b/Misc/NEWS.d/next/Security/2026-03-25-00-51-03.gh-issue-146333.LqdL__bn.rst new file mode 100644 index 00000000000000..96d86ecc0a0fb3 --- /dev/null +++ b/Misc/NEWS.d/next/Security/2026-03-25-00-51-03.gh-issue-146333.LqdL__bn.rst @@ -0,0 +1,3 @@ +Fix quadratic backtracking in :class:`configparser.RawConfigParser` option +parsing regexes (``OPTCRE`` and ``OPTCRE_NV``). A crafted configuration line +with many whitespace characters could cause excessive CPU usage.