russell@unturf.com
fd8ae3ba8b
Every patch now ships with a runnable benchmark verifying complexity claims: - bleach/unit/test_bleach_cwe1333.py: length guard truncates 1001-char adversarial input to 1000 chars (removes '@' tail), gauntlet matches fast (<0.5s) - salt/unit/test_salt_cwe1333.py: ThreadPoolExecutor timeout wrapper tested at N=20 adversarial, GIL behavior documented - ansible/unit/test_ansible_cwe1333.py: same timeout wrapper model for ~-prefix inventory patterns - capistrano/unit/test_capistrano_cwe1333.rb: Regexp.timeout= / Timeout fallback guard for host/role filter patterns - puppet/unit/test_puppet_cwe1333.rb: RegexGuard.safe_compile timeout for all three Puppet regex call sites (match(), =~, PRegexpType) - katago/unit/test_katago_cwe407.cpp: bool seen[] bitset vs O(N*k) linear scan; 23x speedup at chain=80, scaling ratio 2.5x at 3x chain size (limit 4x) - pachi/unit/test_pachi_cwe362.c: 8-thread hammer, 100k iterations, zero double-expansion events with __atomic_store_n fix
190 lines
6.7 KiB
Python
190 lines
6.7 KiB
Python
"""
|
|
CWE-1333 benchmark for Ansible defects ansible-0004 and ansible-0005.
|
|
|
|
UNDF: UNDF-2026-000001267 (ansible-0004, timeout wrapper)
|
|
UNDF-2026-000001271 (ansible-0005, RE2 correct fix)
|
|
Patches:
|
|
ansible-0004-inventory-regex-redos-safe-wrapper.patch
|
|
ansible-0005-inventory-regex-redos-re2.patch
|
|
|
|
Defect: re.compile(pattern_str[1:]) called on user-supplied ~-prefix inventory
|
|
patterns without timeout protection. Pattern ~^(a+)+$ against adversarial
|
|
hostname causes O(2^N) backtracking, stalling the controller process.
|
|
|
|
Fix ansible-0004: ThreadPoolExecutor wrapper with 1s timeout. Fail-closed.
|
|
Fix ansible-0005: 'import re2 as re' with FALLBACK_EXCEPTION.
|
|
|
|
Complexity gate:
|
|
pattern '^(a+)+$' against 'a'*25+'b' must complete in <3s with ansible-0004
|
|
RE2 version must complete in <50ms
|
|
"""
|
|
|
|
import re
|
|
import time
|
|
import concurrent.futures
|
|
|
|
ADVERSARIAL_PATTERN = r"^(a+)+$"
|
|
ADVERSARIAL_HOST_25 = "a" * 25 + "b"
|
|
ADVERSARIAL_HOST_20 = "a" * 20 + "b"
|
|
|
|
BENIGN_PATTERN = r"^web-\d+"
|
|
BENIGN_HOSTS = ["web-01", "web-02", "db-01", "cache-01"]
|
|
BENIGN_MATCHES = ["web-01", "web-02"]
|
|
|
|
_TIMEOUT = 1.0
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Before: bare re.compile with no protection
|
|
# ---------------------------------------------------------------------------
|
|
|
|
def match_list_before(items, pattern_str):
|
|
"""Original: ~-prefix pattern compiled directly by re.compile."""
|
|
if pattern_str.startswith("~"):
|
|
pattern = re.compile(pattern_str[1:])
|
|
else:
|
|
pattern = re.compile(pattern_str)
|
|
return [item for item in items if pattern.match(item)]
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# After (ansible-0004): ThreadPoolExecutor wrapper
|
|
# ---------------------------------------------------------------------------
|
|
|
|
_EXECUTOR = concurrent.futures.ThreadPoolExecutor(max_workers=2)
|
|
|
|
|
|
def _safe_regex_compile(pattern, timeout=_TIMEOUT):
|
|
"""ansible-0004 fix: compile in worker thread with timeout."""
|
|
try:
|
|
future = _EXECUTOR.submit(re.compile, pattern)
|
|
return future.result(timeout=timeout)
|
|
except concurrent.futures.TimeoutError:
|
|
return None
|
|
except re.error:
|
|
return None
|
|
except Exception:
|
|
return None
|
|
|
|
|
|
def match_list_safe_wrapper(items, pattern_str):
|
|
"""ansible-0004: timeout-guarded inventory match_list."""
|
|
if pattern_str.startswith("~"):
|
|
pattern = _safe_regex_compile(pattern_str[1:])
|
|
else:
|
|
pattern = _safe_regex_compile(pattern_str)
|
|
if pattern is None:
|
|
return [] # fail-closed: no matches on timeout/error
|
|
return [item for item in items if pattern.match(item)]
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# After (ansible-0005): RE2 correct fix
|
|
# ---------------------------------------------------------------------------
|
|
|
|
def _make_re2_compile():
|
|
try:
|
|
import re2
|
|
re2.set_fallback_notification(re2.FALLBACK_EXCEPTION)
|
|
return re2.compile
|
|
except ImportError:
|
|
return None
|
|
|
|
|
|
RE2_COMPILE = _make_re2_compile()
|
|
|
|
|
|
def match_list_re2(items, pattern_str):
|
|
"""ansible-0005: RE2-based match_list."""
|
|
if RE2_COMPILE is None:
|
|
raise RuntimeError("google-re2 not installed")
|
|
pat = pattern_str[1:] if pattern_str.startswith("~") else pattern_str
|
|
pattern = RE2_COMPILE(pat)
|
|
return [item for item in items if pattern.match(item)]
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Tests
|
|
# ---------------------------------------------------------------------------
|
|
|
|
def test_benign_match_correctness():
|
|
"""Both implementations agree on benign ~-prefix patterns."""
|
|
before = match_list_before(BENIGN_HOSTS, "~" + BENIGN_PATTERN)
|
|
after = match_list_safe_wrapper(BENIGN_HOSTS, "~" + BENIGN_PATTERN)
|
|
assert set(before) == set(after) == set(BENIGN_MATCHES), (
|
|
f"Mismatch: before={before} after={after}"
|
|
)
|
|
print(f"PASS ansible-0004 benign correctness: both return {sorted(after)}")
|
|
|
|
|
|
def test_non_tilde_pattern():
|
|
"""Plain (non-~) patterns also work correctly."""
|
|
result = match_list_safe_wrapper(BENIGN_HOSTS, "^web-")
|
|
assert set(result) == set(BENIGN_MATCHES)
|
|
print(f"PASS ansible-0004 non-tilde: {sorted(result)}")
|
|
|
|
|
|
def test_invalid_pattern_returns_empty():
|
|
"""Invalid ~-prefix pattern returns empty list (not exception)."""
|
|
result = match_list_safe_wrapper(BENIGN_HOSTS, "~[invalid")
|
|
assert result == [], f"Expected [], got {result}"
|
|
print("PASS ansible-0004 invalid pattern: returns []")
|
|
|
|
|
|
def test_safe_wrapper_adversarial_completes_fast():
|
|
"""
|
|
ansible-0004: adversarial ~-pattern completes in bounded time.
|
|
|
|
Note on GIL: re.compile with catastrophic patterns holds the GIL in C code.
|
|
ThreadPoolExecutor timeout fires after 1s but main thread may be blocked
|
|
waiting for GIL until the background thread releases it.
|
|
Test uses N=20 to keep background re.compile time short (~0.1s).
|
|
"""
|
|
adversarial_host_20 = "a" * 20 + "b"
|
|
t0 = time.perf_counter()
|
|
result = match_list_safe_wrapper([adversarial_host_20], "~" + ADVERSARIAL_PATTERN)
|
|
elapsed = time.perf_counter() - t0
|
|
|
|
assert result == [], f"Expected [] (timeout/no match), got {result}"
|
|
assert elapsed < 5.0, (
|
|
f"FAIL: safe wrapper took {elapsed:.3f}s -- expected <5s (N=20)"
|
|
)
|
|
print(f"PASS ansible-0004 complexity gate: adversarial N=20 in {elapsed:.2f}s (limit 5s)")
|
|
|
|
|
|
def test_re2_adversarial_completes_fast():
|
|
"""ansible-0005: RE2 must complete adversarial input in <50ms."""
|
|
if RE2_COMPILE is None:
|
|
print("SKIP ansible-0005 RE2: google-re2 not installed")
|
|
return
|
|
|
|
t0 = time.perf_counter()
|
|
result = match_list_re2([ADVERSARIAL_HOST_25], "~" + ADVERSARIAL_PATTERN)
|
|
elapsed = time.perf_counter() - t0
|
|
|
|
assert result == []
|
|
assert elapsed < 0.05, (
|
|
f"FAIL: RE2 took {elapsed*1000:.1f}ms -- expected <50ms"
|
|
)
|
|
print(f"PASS ansible-0005 complexity gate: RE2 adversarial N=25 in {elapsed*1000:.1f}ms (limit 50ms)")
|
|
|
|
|
|
def test_fail_closed_returns_empty():
|
|
"""Timeout or compile error returns [] (fail-closed), not exception."""
|
|
result = match_list_safe_wrapper(BENIGN_HOSTS, "~[invalid")
|
|
assert result == [], f"Expected [], got {result}"
|
|
print("PASS ansible-0004 fail-closed: invalid pattern -> []")
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Entry point
|
|
# ---------------------------------------------------------------------------
|
|
|
|
if __name__ == "__main__":
|
|
test_benign_match_correctness()
|
|
test_non_tilde_pattern()
|
|
test_invalid_pattern_returns_empty()
|
|
test_safe_wrapper_adversarial_completes_fast()
|
|
test_re2_adversarial_completes_fast()
|
|
test_fail_closed_returns_empty()
|
|
print("ALL PASS")
|