René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"CVE-2020-10735: Prevent DoS by large int\u003c-\u003estr conversions","articleBody":"## Problem\r\n\r\nA Denial Of Service (DoS) issue was identified in CPython because we use binary bignum’s for our `int` implementation. A huge integer will always consume a near-quadratic amount of CPU time in conversion to or from a base 10 (decimal) string with a large number of digits. No efficient algorithm exists to do otherwise.\r\n\r\nIt is quite common for Python code implementing network protocols and data serialization to do `int(untrusted_string_or_bytes_value)` on input to get a numeric value, without having limited the input length or to do `log(\"processing thing id %s\", unknowingly_huge_integer)` or any similar concept to convert an `int` to a string without first checking its magnitude. (`http`, `json`, `xmlrpc`, `logging`, loading large values into integer via linear-time conversions such as hexadecimal stored in `yaml`, or anything computing larger values based on user controlled inputs… which then wind up attempting to output as decimal later on). All of these can suffer a CPU consuming DoS in the face of untrusted data.\r\n\r\nEveryone auditing all existing code for this, adding length guards, and maintaining that practice everywhere is not feasible nor is it what we deem the vast majority of our users want to do.\r\n\r\nThis issue has been reported to the Python Security Response Team multiple times by a few different people since early 2020, most recently a few weeks ago while I was in the middle of polishing up the PR so it’d be ready before 3.11.0rc2.\r\n\r\n## Mitigation\r\nAfter discussion on the Python Security Response Team mailing list the conclusion was that we needed to limit the size of integer to string conversions for non-linear time conversions (anything not a power-of-2 base) by default. And offer the ability to configure or disable this limit.\r\n\r\nThe Python Steering Council is aware of this change and accepts it as necessary.\r\n\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-100627\n* gh-100628\n* gh-101065\n* gh-101066\n* gh-101630\n* gh-101631\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/gpshead","@type":"Person","name":"gpshead"},"datePublished":"2022-08-08T07:53:39.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":24},"url":"https://github.com/95778/cpython/issues/95778"}