File CVE-2022-40899-ReDos-cookiejar.patch of Package python3.35118
Index: Python-3.4.10/Lib/http/cookiejar.py
===================================================================
--- Python-3.4.10.orig/Lib/http/cookiejar.py
+++ Python-3.4.10/Lib/http/cookiejar.py
@@ -213,10 +213,14 @@ LOOSE_HTTP_DATE_RE = re.compile(
(?::(\d\d))? # optional seconds
)? # optional clock
\s*
- ([-+]?\d{2,4}|(?![APap][Mm]\b)[A-Za-z]+)? # timezone
+ (?:
+ ([-+]?\d{2,4}|(?![APap][Mm]\b)[A-Za-z]+) # timezone
\s*
- (?:\(\w+\))? # ASCII representation of timezone in parens.
- \s*$""", re.X | re.ASCII)
+ )?
+ (?:
+ \(\w+\) # ASCII representation of timezone in parens.
+ \s*
+ )?$""", re.X | re.ASCII)
def http2time(text):
"""Returns time in seconds since epoch of time represented by a string.
@@ -274,7 +278,7 @@ def http2time(text):
return _str2time(day, mon, yr, hr, min, sec, tz)
ISO_DATE_RE = re.compile(
- """^
+ r"""^
(\d{4}) # year
[-\/]?
(\d\d?) # numerical month
@@ -286,9 +290,11 @@ ISO_DATE_RE = re.compile(
(?::?(\d\d(?:\.\d*)?))? # optional seconds (and fractional)
)? # optional clock
\s*
- ([-+]?\d\d?:?(:?\d\d)?
- |Z|z)? # timezone (Z is "zero meridian", i.e. GMT)
- \s*$""", re.X | re. ASCII)
+ (?:
+ ([-+]?\d\d?:?(:?\d\d)?
+ |Z|z) # timezone (Z is "zero meridian", i.e. GMT)
+ \s*
+ )?$""", re.X | re. ASCII)
def iso2time(text):
"""
As for http2time, but parses the ISO 8601 formats: