Skip to content

Dependency: Black vulnerable to Regular Expression Denial of Service (ReDoS) #3841

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
JessieTeng89 opened this issue Apr 9, 2024 · 1 comment · Fixed by #3871
Closed

Dependency: Black vulnerable to Regular Expression Denial of Service (ReDoS) #3841

JessieTeng89 opened this issue Apr 9, 2024 · 1 comment · Fixed by #3871
Labels
bug Something isn't working

Comments

@JessieTeng89
Copy link

Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.

Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.
@JessieTeng89 JessieTeng89 added the bug Something isn't working label Apr 9, 2024
@JessieTeng89
Copy link
Author

I will create a PR for this.

xrmx added a commit to xrmx/opentelemetry-python that referenced this issue Apr 16, 2024
@xrmx
Bump black to 24.3.0
81c8fee 
Fix open-telemetry#3841
xrmx added a commit to xrmx/opentelemetry-python that referenced this issue Apr 23, 2024
@xrmx
Bump black to 24.3.0
e454e52 
Fix open-telemetry#3841
@xrmx xrmx mentioned this issue Apr 23, 2024
Merged
11 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Bump black to 24.3.0 xrmx/opentelemetry-python
1 participant
@JessieTeng89