The regex to decode a number in fpformat is susceptible to catastrophic backtracking. This is a potential DOS vector if a server is using fpformat on untrusted number strings.
Replace it with an equivalent non-vulnerable regex. The match behavior of the new regex is slightly different. It captures the whole integer part of the number in one group, Leading zeros are stripped off later.
who writes:
Here is batch 2, as a big collection of CVS context diffs.
Along with moving comments into docstrings, i've added a
couple of missing docstrings and attempted to make sure more
module docstrings begin with a one-line summary.
I did not add docstrings to the methods in profile.py for
fear of upsetting any careful optimizations there, though
i did move class documentation into class docstrings.
The convention i'm using is to leave credits/version/copyright
type of stuff in # comments, and move the rest of the descriptive
stuff about module usage into module docstrings. Hope this is
okay.
1. Comments at the beginning of the module, before
functions, and before classes have been turned
into docstrings.
2. Tabs are normalized to four spaces.
Also, removed the "remove" function from dircmp.py, which reimplements
list.remove() (it must have been very old).
Jamie Davis
Brett Cannon
Walter Dörwald
Skip Montanaro
Tim Peters
Guido van Rossum
Fred Drake