Repository navigation
Inefficient regex in extract_full_summary_from_signature #281
Description
As pointed out by https://gist.github.com/prodigysml/d07cd482214c80bfb6d3240454d2f679, this regex (introduced by 430c39e, #8) is inefficient:
Line 18 in e0c1411
It tries to match a string such as:
:param command_loader: The command loader that commands will be registered into
As shown in https://regex101.com/, a simple :param r requires 1214 steps to fail.
:param r causes catastrophic backtracking:
This is because \s+, .+? and \s* all match consecutive spaces, thus can trigger many backtrackings.
A better solution is to replace .+? with \w+ to match the parameter name so that backtrackings can be greatly reduced:
\s*(:param)\s+(\w+)\s*:(.*)
Activity
carnil commented on Aug 21, 2025
This seems to be the issue described by CVE-2025-54363 and CVE-2025-54364.
jiasli commented on Aug 25, 2025
These CVEs are invalid. Knack is a CLI framework used by Azure CLI. It's a local library, not a web service. In addition, the regex is used to extract function and parameter docstrings from the source code. It is not used to match user input. Therefore, it does not expose any attack surface. There is no way to use it for ReDoS attack.
jiasli commented on Aug 25, 2025
\s*(:param)\s+(\w+)\s*:(.*) cannot match docstrings that has type info such as float in it:
I first think of \s*(:param)(.*)\s(\w+):(.*), but it still requires backtracking:
\s*(:param)\s+([^:]+):(.*) looks promising:
Simple string operation such as split can also be used to fully eliminate backtracking.
Therefore, changing it may not be easy. The regex is widely used by Azure CLI's help message and document generation. Changing it needs thorough testing and adding more arguments in
knack/tests/test_introspection.py
Lines 11 to 15 in 6c07fe7
such as