diff options
Diffstat (limited to 'Lib/test/test_http_cookiejar.py')
| -rw-r--r-- | Lib/test/test_http_cookiejar.py | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/Lib/test/test_http_cookiejar.py b/Lib/test/test_http_cookiejar.py index 767b0fd137..218edeb9e8 100644 --- a/Lib/test/test_http_cookiejar.py +++ b/Lib/test/test_http_cookiejar.py @@ -122,6 +122,13 @@ class DateTimeTests(unittest.TestCase): "http2time(%s) is not None\n" "http2time(test) %s" % (test, http2time(test))) + def test_http2time_redos_regression_actually_completes(self): + # LOOSE_HTTP_DATE_RE was vulnerable to malicious input which caused catastrophic backtracking (REDoS). + # If we regress to cubic complexity, this test will take a very long time to succeed. + # If fixed, it should complete within a fraction of a second. + http2time("01 Jan 1970{}00:00:00 GMT!".format(" " * 10 ** 5)) + http2time("01 Jan 1970 00:00:00{}GMT!".format(" " * 10 ** 5)) + def test_iso2time(self): def parse_date(text): return time.gmtime(iso2time(text))[:6] @@ -181,6 +188,12 @@ class DateTimeTests(unittest.TestCase): "iso2time(%s) is not None\n" "iso2time(test) %s" % (test, iso2time(test))) + def test_iso2time_performance_regression(self): + # If ISO_DATE_RE regresses to quadratic complexity, this test will take a very long time to succeed. + # If fixed, it should complete within a fraction of a second. + iso2time('1994-02-03{}14:15:29 -0100!'.format(' '*10**6)) + iso2time('1994-02-03 14:15:29{}-0100!'.format(' '*10**6)) + class HeaderTests(unittest.TestCase): |