Blame SOURCES/bz1943464-python-pygments-fix-CVE-2021-27291.patch

0c4b27
From 2e7e8c4a7b318f4032493773732754e418279a14 Mon Sep 17 00:00:00 2001
0c4b27
From: Georg Brandl <georg@python.org>
0c4b27
Date: Mon, 11 Jan 2021 09:46:34 +0100
0c4b27
Subject: [PATCH] Fix several exponential/cubic complexity regexes found by Ben
0c4b27
 Caller/Doyensec
0c4b27
0c4b27
---
0c4b27
 pygments/lexers/archetype.py | 2 +-
0c4b27
 pygments/lexers/factor.py    | 4 ++--
0c4b27
 pygments/lexers/jvm.py       | 1 -
0c4b27
 pygments/lexers/matlab.py    | 6 +++---
0c4b27
 pygments/lexers/objective.py | 4 ++--
0c4b27
 pygments/lexers/templates.py | 2 +-
0c4b27
 pygments/lexers/varnish.py   | 2 +-
0c4b27
 8 files changed, 14 insertions(+), 12 deletions(-)
0c4b27
0c4b27
diff --git a/pygments/lexers/archetype.py b/pygments/lexers/archetype.py
0c4b27
index 65046613d..26f5ea8c9 100644
0c4b27
--- a/pygments/lexers/archetype.py
0c4b27
+++ b/pygments/lexers/archetype.py
0c4b27
@@ -58,7 +58,7 @@ class AtomsLexer(RegexLexer):
0c4b27
             (r'P((\d*(\.\d+)?[YyMmWwDd]){1,3}(T(\d*(\.\d+)?[HhMmSs]){,3})?|'
0c4b27
              r'T(\d*(\.\d+)?[HhMmSs]){,3})', Literal.Date),
0c4b27
             (r'[+-]?(\d+\.\d*|\.\d+|\d+)[eE][+-]?\d+', Number.Float),
0c4b27
-            (r'[+-]?(\d+)*\.\d+%?', Number.Float),
0c4b27
+            (r'[+-]?\d*\.\d+%?', Number.Float),
0c4b27
             (r'0x[0-9a-fA-F]+', Number.Hex),
0c4b27
             (r'[+-]?\d+%?', Number.Integer),
0c4b27
         ],
0c4b27
diff --git a/pygments/lexers/factor.py b/pygments/lexers/factor.py
0c4b27
index be7b30dff..9200547f9 100644
0c4b27
--- a/pygments/lexers/factor.py
0c4b27
+++ b/pygments/lexers/factor.py
0c4b27
@@ -265,7 +265,7 @@ class FactorLexer(RegexLexer):
0c4b27
             (r'(?:<PRIVATE|PRIVATE>)\s', Keyword.Namespace),
0c4b27
 
0c4b27
             # strings
0c4b27
-            (r'"""\s+(?:.|\n)*?\s+"""', String),
0c4b27
+            (r'"""\s(?:.|\n)*?\s"""', String),
0c4b27
             (r'"(?:\\\\|\\"|[^"])*"', String),
0c4b27
             (r'\S+"\s+(?:\\\\|\\"|[^"])*"', String),
0c4b27
             (r'CHAR:\s+(?:\\[\\abfnrstv]|[^\\]\S*)\s', String.Char),
0c4b27
@@ -322,7 +322,7 @@ class FactorLexer(RegexLexer):
0c4b27
         'slots': [
0c4b27
             (r'\s+', Text),
0c4b27
             (r';\s', Keyword, '#pop'),
0c4b27
-            (r'(\{\s+)(\S+)(\s+[^}]+\s+\}\s)',
0c4b27
+            (r'(\{\s+)(\S+)(\s[^}]+\s\}\s)',
0c4b27
              bygroups(Text, Name.Variable, Text)),
0c4b27
             (r'\S+', Name.Variable),
0c4b27
         ],
0c4b27
diff --git a/pygments/lexers/jvm.py b/pygments/lexers/jvm.py
0c4b27
index 62dfd45e5..9a9397c2d 100644
0c4b27
--- a/pygments/lexers/jvm.py
0c4b27
+++ b/pygments/lexers/jvm.py
0c4b27
@@ -981,7 +981,6 @@ class CeylonLexer(RegexLexer):
0c4b27
             (r'(import)(\s+)', bygroups(Keyword.Namespace, Text), 'import'),
0c4b27
             (r'"(\\\\|\\[^\\]|[^"\\])*"', String),
0c4b27
             (r"'\\.'|'[^\\]'|'\\\{#[0-9a-fA-F]{4}\}'", String.Char),
0c4b27
-            (r'".*``.*``.*"', String.Interpol),
0c4b27
             (r'(\.)([a-z_]\w*)',
0c4b27
              bygroups(Operator, Name.Attribute)),
0c4b27
             (r'[a-zA-Z_]\w*:', Name.Label),
0c4b27
diff --git a/pygments/lexers/matlab.py b/pygments/lexers/matlab.py
0c4b27
index 4823c6a7e..578848623 100644
0c4b27
--- a/pygments/lexers/matlab.py
0c4b27
+++ b/pygments/lexers/matlab.py
0c4b27
@@ -137,7 +137,7 @@ class MatlabLexer(RegexLexer):
0c4b27
             (r'.', Comment.Multiline),
0c4b27
         ],
0c4b27
         'deffunc': [
0c4b27
-            (r'(\s*)(?:(.+)(\s*)(=)(\s*))?(.+)(\()(.*)(\))(\s*)',
0c4b27
+            (r'(\s*)(?:(\S+)(\s*)(=)(\s*))?(.+)(\()(.*)(\))(\s*)',
0c4b27
              bygroups(Whitespace, Text, Whitespace, Punctuation,
0c4b27
                       Whitespace, Name.Function, Punctuation, Text,
0c4b27
                       Punctuation, Whitespace), '#pop'),
0c4b27
@@ -638,7 +638,7 @@ class OctaveLexer(RegexLexer):
0c4b27
             (r"[^']*'", String, '#pop'),
0c4b27
         ],
0c4b27
         'deffunc': [
0c4b27
-            (r'(\s*)(?:(.+)(\s*)(=)(\s*))?(.+)(\()(.*)(\))(\s*)',
0c4b27
+            (r'(\s*)(?:(\S+)(\s*)(=)(\s*))?(.+)(\()(.*)(\))(\s*)',
0c4b27
              bygroups(Whitespace, Text, Whitespace, Punctuation,
0c4b27
                       Whitespace, Name.Function, Punctuation, Text,
0c4b27
                       Punctuation, Whitespace), '#pop'),
0c4b27
@@ -710,7 +710,7 @@ class ScilabLexer(RegexLexer):
0c4b27
             (r'.', String, '#pop'),
0c4b27
         ],
0c4b27
         'deffunc': [
0c4b27
-            (r'(\s*)(?:(.+)(\s*)(=)(\s*))?(.+)(\()(.*)(\))(\s*)',
0c4b27
+            (r'(\s*)(?:(\S+)(\s*)(=)(\s*))?(.+)(\()(.*)(\))(\s*)',
0c4b27
              bygroups(Whitespace, Text, Whitespace, Punctuation,
0c4b27
                       Whitespace, Name.Function, Punctuation, Text,
0c4b27
                       Punctuation, Whitespace), '#pop'),
0c4b27
diff --git a/pygments/lexers/objective.py b/pygments/lexers/objective.py
0c4b27
index 34e4062f6..38ac9bb05 100644
0c4b27
--- a/pygments/lexers/objective.py
0c4b27
+++ b/pygments/lexers/objective.py
0c4b27
@@ -261,11 +261,11 @@ class LogosLexer(ObjectiveCppLexer):
0c4b27
              'logos_classname'),
0c4b27
             (r'(%hook|%group)(\s+)([a-zA-Z$_][\w$]+)',
0c4b27
              bygroups(Keyword, Text, Name.Class)),
0c4b27
-            (r'(%config)(\s*\(\s*)(\w+)(\s*=\s*)(.*?)(\s*\)\s*)',
0c4b27
+            (r'(%config)(\s*\(\s*)(\w+)(\s*=)(.*?)(\)\s*)',
0c4b27
              bygroups(Keyword, Text, Name.Variable, Text, String, Text)),
0c4b27
             (r'(%ctor)(\s*)(\{)', bygroups(Keyword, Text, Punctuation),
0c4b27
              'function'),
0c4b27
-            (r'(%new)(\s*)(\()(\s*.*?\s*)(\))',
0c4b27
+            (r'(%new)(\s*)(\()(.*?)(\))',
0c4b27
              bygroups(Keyword, Text, Keyword, String, Keyword)),
0c4b27
             (r'(\s*)(%end)(\s*)', bygroups(Text, Keyword, Text)),
0c4b27
             inherit,
0c4b27
diff --git a/pygments/lexers/templates.py b/pygments/lexers/templates.py
0c4b27
index 33c06c4c4..5c3346b4c 100644
0c4b27
--- a/pygments/lexers/templates.py
0c4b27
+++ b/pygments/lexers/templates.py
0c4b27
@@ -1405,7 +1405,7 @@ class EvoqueLexer(RegexLexer):
0c4b27
             # see doc for handling first name arg: /directives/evoque/
0c4b27
             # + minor inconsistency: the "name" in e.g. $overlay{name=site_base}
0c4b27
             # should be using(PythonLexer), not passed out as String
0c4b27
-            (r'(\$)(evoque|overlay)(\{(%)?)(\s*[#\w\-"\'.]+[^=,%}]+?)?'
0c4b27
+            (r'(\$)(evoque|overlay)(\{(%)?)(\s*[#\w\-"\'.]+)?'
0c4b27
              r'(.*?)((?(4)%)\})',
0c4b27
              bygroups(Punctuation, Name.Builtin, Punctuation, None,
0c4b27
                       String, using(PythonLexer), Punctuation)),
0c4b27
diff --git a/pygments/lexers/varnish.py b/pygments/lexers/varnish.py
0c4b27
index 23653f7a1..9d358bd7c 100644
0c4b27
--- a/pygments/lexers/varnish.py
0c4b27
+++ b/pygments/lexers/varnish.py
0c4b27
@@ -61,7 +61,7 @@ def analyse_text(text):
0c4b27
              bygroups(Name.Attribute, Operator, Name.Variable.Global, Punctuation)),
0c4b27
             (r'(\.probe)(\s*=\s*)(\{)',
0c4b27
              bygroups(Name.Attribute, Operator, Punctuation), 'probe'),
0c4b27
-            (r'(\.\w+\b)(\s*=\s*)([^;]*)(\s*;)',
0c4b27
+            (r'(\.\w+\b)(\s*=\s*)([^;\s]*)(\s*;)',
0c4b27
              bygroups(Name.Attribute, Operator, using(this), Punctuation)),
0c4b27
             (r'\{', Punctuation, '#push'),
0c4b27
             (r'\}', Punctuation, '#pop'),