| 标题 | langflow-ai langflow <=v1.0.18 Redos |
|---|
| 描述 | The following code in `langflow-1.0.18\src\backend\base\langflow\interface\utils.py` could lead to a ReDoS (Regular Expression Denial of Service) attack:
```
pattern = r"\{\{(.*?)\}\}|\{([^{}]+)\}"
while True:
match = re.search(pattern, remaining_text)
```
`remaining_text` is the `prompt_request.template` parameter transmitted by the user via a POST method:
```
@router.post("/prompt", status_code=200, response_model=PromptValidationResponse)
def post_validate_prompt(prompt_request: ValidatePromptRequest):
try:
if not prompt_request.frontend_node:
return PromptValidationResponse(
input_variables=[],
frontend_node=None,
)
# Process the prompt template using direct attributes
input_variables = process_prompt_template(
template=prompt_request.template,
name=prompt_request.name,
custom_fields=prompt_request.frontend_node.custom_fields,
frontend_node_template=prompt_request.frontend_node.template,
)
return PromptValidationResponse(
input_variables=input_variables,
frontend_node=prompt_request.frontend_node,
)
except Exception as e:
logger.exception(e)
raise HTTPException(status_code=500, detail=str(e)) from e
```
|
|---|
| 来源 | ⚠️ https://rumbling-slice-eb0.notion.site/Remote-Redos-in-https-github-com-langflow-ai-langflow-067159ced0d5494e91b06071384969c4?pvs=4 |
|---|
| 用户 | HRP_0 (UID 75007) |
|---|
| 提交 | 2024-09-18 07時38分 (2 年前) |
|---|
| 管理 | 2024-09-27 07時32分 (9 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 278659 [Langflow 直到 1.0.18 HTTP POST Request utils.py remaining_text 拒绝服务] |
|---|
| 积分 | 17 |
|---|