From 771472cfdaeebc0d89a9cc46e249f8891a6b29cd Mon Sep 17 00:00:00 2001 From: Ben Darnell Date: Wed, 10 Dec 2025 10:55:02 -0500 Subject: [PATCH] httputil: Fix quadratic behavior in _parseparam Prior to this change, _parseparam had O(n^2) behavior when parsing certain inputs, which could be a DoS vector. This change adapts logic from the equivalent function in the python standard library in https://github.com/python/cpython/pull/136072/files CVE: CVE-2025-67725 CVE: CVE-2025-67726 Upstream: https://github.com/tornadoweb/tornado/commit/771472cfdaeebc0d89a9cc46e249f8891a6b29cd Signed-off-by: Thomas Perale --- tornado/httputil.py | 29 ++++++++++++++++++++++------- tornado/test/httputil_test.py | 23 +++++++++++++++++++++++ 2 files changed, 45 insertions(+), 7 deletions(-) diff --git a/tornado/httputil.py b/tornado/httputil.py index 1c48db414..7fa30975d 100644 --- a/tornado/httputil.py +++ b/tornado/httputil.py @@ -1094,19 +1094,34 @@ def parse_response_start_line(line: str) -> ResponseStartLine: # It has also been modified to support valueless parameters as seen in # websocket extension negotiations, and to support non-ascii values in # RFC 2231/5987 format. +# +# _parseparam has been further modified with the logic from +# https://github.com/python/cpython/pull/136072/files +# to avoid quadratic behavior when parsing semicolons in quoted strings. +# +# TODO: See if we can switch to email.message.Message for this functionality. +# This is the suggested replacement for the cgi.py module now that cgi has +# been removed from recent versions of Python. We need to verify that +# the email module is consistent with our existing behavior (and all relevant +# RFCs for multipart/form-data) before making this change. def _parseparam(s: str) -> Generator[str, None, None]: - while s[:1] == ";": - s = s[1:] - end = s.find(";") - while end > 0 and (s.count('"', 0, end) - s.count('\\"', 0, end)) % 2: - end = s.find(";", end + 1) + start = 0 + while s.find(";", start) == start: + start += 1 + end = s.find(";", start) + ind, diff = start, 0 + while end > 0: + diff += s.count('"', ind, end) - s.count('\\"', ind, end) + if diff % 2 == 0: + break + end, ind = ind, s.find(";", end + 1) if end < 0: end = len(s) - f = s[:end] + f = s[start:end] yield f.strip() - s = s[end:] + start = end def _parse_header(line: str) -> Tuple[str, Dict[str, str]]: