Mikaela/Limnoria
1
0
Fork 0
mirror of https://github.com/Mikaela/Limnoria.git synced 2024-12-23 19:22:45 +01:00
Code Issues Projects Releases Wiki Activity

Misc: fix potential ddos when misc.last command is fed a specially-crafted regexp.

Browse Source 
Signed-off-by: James McCoy <jamessan@users.sourceforge.net>
This commit is contained in:
Daniel Folkinshteyn 2011-08-12 16:30:46 -04:00 committed by James McCoy
parent 72c5c8ec09
commit 9356d0734f
1 changed files with 18 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
plugins/Misc/plugin.py
View File

@ -35,6 +35,7 @@ import time
import supybot import supybot
import supybot.conf as conf import supybot.conf as conf
from supybot import commands
import supybot.utils as utils import supybot.utils as utils
from supybot.commands import * from supybot.commands import *
import supybot.ircdb as ircdb import supybot.ircdb as ircdb
@ -312,10 +313,25 @@ class Misc(callbacks.Plugin):
predicates.setdefault('without', []).append(f) predicates.setdefault('without', []).append(f)
elif option == 'regexp': elif option == 'regexp':
def f(m, arg=arg): def f(m, arg=arg):
def f1(s, arg):
"""Since we can't enqueue match objects into the multiprocessing queue,
we'll just wrap the function to return bools."""
if arg.search(s) is not None:
return True
else:
return False
if ircmsgs.isAction(m): if ircmsgs.isAction(m):
return arg.search(ircmsgs.unAction(m)) m1 = ircmsgs.unAction(m)
else: else:
return arg.search(m.args[1]) m1 = m.args[1]
try:
# use a subprocess here, since specially crafted regexps can
# take exponential time and hang up the bot.
# timeout of 0.1 should be more than enough for any normal regexp.
v = commands.process(f1, m1, arg, timeout=0.1, pn=self.name(), cn='last')
return v
except commands.ProcessTimeoutError:
return False
predicates.setdefault('regexp', []).append(f) predicates.setdefault('regexp', []).append(f)
elif option == 'nolimit': elif option == 'nolimit':
nolimit = True nolimit = True