]> git.ipfire.org Git - thirdparty/tornado.git/commit
httputil: Fix quadratic behavior in _parseparam 3554/head
authorBen Darnell <ben@bendarnell.com>
Wed, 10 Dec 2025 15:55:02 +0000 (10:55 -0500)
committerBen Darnell <ben@bendarnell.com>
Wed, 10 Dec 2025 15:55:02 +0000 (10:55 -0500)
commit03198b55f580c7c3e88bfac0a0c459357f9ac177
treef1c1fd9c28c1b1164292a10ebbefacfc2fcc44d9
parent7d869bf2b17ae14c364b862d7f6dde7274e79fb9
httputil: Fix quadratic behavior in _parseparam

Prior to this change, _parseparam had O(n^2) behavior when parsing
certain inputs, which could be a DoS vector. This change adapts
logic from the equivalent function in the python standard library
in https://github.com/python/cpython/pull/136072/files
tornado/httputil.py
tornado/test/httputil_test.py