← Back to issue list

Fix ReDoS (GHSL-2024-323)

View original Github issue

Metadata

Project
snapcraft
Number
#5210
Type
pull request
State
closed
Author
kevinbackhouse
Labels
—
Created
Updated
Closed

Current evaluation

External contributor's GHSL-2024-323 ReDoS fix for the duration regex was closed unmerged; author kevinbackhouse deferred to maintainer @lengau's PR #5213, merged as commit b71e72ac4.

Resolution: closed superseded

Reason: Author closed the PR on 2025-01-22 stating 'Your version is better... I'll close this PR now', deferring to lengau's PR #5213, which replaced the vulnerable TIME_DURATION_REGEX with an annotated duration type and stricter regex and merged as commit b71e72ac4.

Evaluated by: mr-cal-bot

No scores available.

Issue body

- [x] Have you followed the [guidelines for contributing](https://github.com/canonical/snapcraft/blob/main/CONTRIBUTING.md)? - [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)? - [ ] Have you successfully run `tox run -m lint`? - [ ] Have you successfully run `tox run -e test-py310`? (supported versions: `py39`, `py310`, `py311`, `py312`) ----- Fixes a ReDoS: https://bugs.launchpad.net/snapcraft/+bug/2086622 (GHSL-2024-323)

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed superseded External contributor's GHSL-2024-323 ReDoS fix for the duration regex was closed unmerged; author kevinbackhouse deferred to maintainer @lengau's PR #5213, merged as commit b71e72ac4.
stealth/space-bunny-alpha — closed superseded Closed unmerged after the author deferred to PR #5213, which addresses GHSL-2024-323 with a stricter duration-string regex.
qwen/qwen3.6-35b-a3b — — Superseded by PR #5213, which resolves the ReDoS vulnerability (GHSL-2024-323) and corrects the underlying regex logic. The original author acknowledged the improved fix and closed this pull request.
qwen3.6-35b-a3b-mtp-q6 — — Superseded by PR #5213. The original pull request addressed a ReDoS vulnerability (GHSL-2024-323), but a maintainer submitted a superior fix that also corrects the underlying regex. The original PR was closed in favor of the maintainer's solution.

Update history

No update history recorded yet.

Related work

  • Superseded By: canonical/snapcraft#5213 (confidence 98%)

    lengau's PR fixing GHSL-2024-323 with a stricter duration regex/annotated type; merged as b71e72ac4

  • Likely Fixed By: canonical/snapcraft#5213 (confidence 95%)

    Resulting code shows TIME_DURATION_REGEX tightened with an annotated duration type and pydantic pattern usage in snapcraft/models/project.py

Related issues

No related issues found above the similarity threshold.