10000 bpo-34866: Adding max_num_fields to cgi.FieldStorage by matthewbelisle-wf · Pull Request #9660 · python/cpython · GitHub
[go: up one dir, main page]
Skip to content

bpo-34866: Adding max_num_fields to cgi.FieldStorage #9660

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
Oct 19, 2018
Merged

bpo-34866: Adding max_num_fields to cgi.FieldStorage #9660

Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
d846e2b
Adding max_num_fields to cgi.FieldStorage
matthewbelisle-wf Oct 1, 2018
21e5e48
Propagating max_num_fields to FieldStorage subclass
matthewbelisle-wf Oct 3, 2018
27352e9
Fixing typos
matthewbelisle-wf Oct 4, 2018
ab0eb93
Fixing annotation
matthewbelisle-wf Oct 5, 2018
7668322
Merge branch 'master' into cgi-max-num-fields
matthewbelisle-wf Oct 5, 2018
60aee01
Merge branch 'master' into cgi-max-num-fields
matthewbelisle-wf Oct 8, 2018
1fa59e4
Using count() instead of finditer() for max_num_fields check
matthewbelisle-wf Oct 18, 2018
20a77f2
Update 2018-10-03-11-07-28.bpo-34866.ML6KpJ.rst
methane Oct 19, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Using count() instead of finditer() for max_num_fields check
  • Loading branch information
@matthewbelisle-wf
matthewbelisle-wf committed Oct 18, 2018
commit 1fa59e4efd44aa3bf0cdcf7b9bd00a7c1ec3fcef
11 changes: 3 additions & 8 deletions Lib/urllib/parse.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -666,11 +666,6 @@ def parse_qs(qs, keep_blank_values=False, strict_parsing=False,
return parsed_result


# Used for checking parse_qsl() with max_num_fields. Both & and ; are valid query
# string delimiters.
_QS_DELIMITER_RE = re.compile(r'[&;]')


def parse_qsl(qs, keep_blank_values=False, strict_parsing=False,
encoding='utf-8', errors='replace', max_num_fields=None):
"""Parse a query given as a string argument.
Expand Down Expand Up @@ -703,9 +698,9 @@ def parse_qsl(qs, keep_blank_values=False, strict_parsing=False,
# is less than max_num_fields. This prevents a memory exhaustion DOS
# attack via post bodies with many fields.
if max_num_fields is not None:
for num_fields, _ in enumerate(_QS_DELIMITER_RE.finditer(qs), 2):
if max_num_fields < num_fields:
raise ValueError('Max number of fields exceeded')
num_fields = 1 + qs.count('&') + qs.count(';')
if max_num_fields < num_fields:
raise ValueError('Max number of fields exceeded')

pairs = [s2 for s1 in qs.split('&') for s2 in s1.split(';')]
r = []
Expand Down
0