gh-136065: Fix quadratic complexity in os.path.expandvars()#134952

Merged

ambv merged 7 commits intopython:mainfrom

serhiy-storchaka:expandvars-quadratic-complexity

Oct 31, 2025

Member

serhiy-storchaka commented May 30, 2025 •

edited by bedevere-app bot

Loading

Issue: A Series of Simple DOS Vulnerabilities #134873

Issue: Potential Quadratic Complexity Vulnerabilities in path Modules #136065

serhiy-storchaka added type-security needs backport to 3.9 needs backport to 3.10 needs backport to 3.11 needs backport to 3.12 needs backport to 3.13 needs backport to 3.14 labels

bedevere-app bot added the awaiting core review label

bedevere-app bot mentioned this pull request

A Series of Simple DOS Vulnerabilities #134873

Closed

serhiy-storchaka mentioned this pull request

gh-134873: Fix a DOS issue in posixpath #134927

Closed


          pythongh-134873: Fix quadratic complexity in os.path.expandvars()

e3b2c85

serhiy-storchaka force-pushed the expandvars-quadratic-complexity branch from f2ab255 to e3b2c85 Compare

May 31, 2025 08:49

serhiy-storchaka requested a review from ambv

June 3, 2025 15:49

serhiy-storchaka added 2 commits

June 3, 2025 18:50


          Merge branch 'main' into expandvars-quadratic-complexity

82dc1d2


          Merge branch 'main' into expandvars-quadratic-complexity

f39ac2c

kexinoh mentioned this pull request

Potential Quadratic Complexity Vulnerabilities in path Modules #136065

Closed

serhiy-storchaka added 2 commits

June 28, 2025 12:44


          Merge branch 'main' into expandvars-quadratic-complexity

4c27ca2


          Move to pythongh-136065.

44ea788

serhiy-storchaka changed the title ~~gh-134873: Fix quadratic complexity in os.path.expandvars()~~ gh-136065: Fix quadratic complexity in os.path.expandvars()

serhiy-storchaka and others added 2 commits

July 25, 2025 12:26


          Merge branch 'main' into expandvars-quadratic-complexity

b0ff6b4


          Merge branch 'main' into expandvars-quadratic-complexity

6a511ae

ambv merged commit f029e8d into python:main

46 checks passed

miss-islington-app bot commented Oct 31, 2025

Thanks @serhiy-storchaka for the PR, and @ambv for merging it 🌮🎉.. I'm working now to backport this PR to: 3.9, 3.10, 3.11, 3.12, 3.13, 3.14.
🐍🍒⛏🤖

bedevere-app bot removed the awaiting core review label

miss-islington-app bot commented Oct 31, 2025

Sorry, @serhiy-storchaka and @ambv, I could not cleanly backport this to 3.14 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker f029e8db626ddc6e3a3beea4eff511a71aaceb5c 3.14

miss-islington-app bot assigned ambv

miss-islington-app bot commented Oct 31, 2025

Sorry, @serhiy-storchaka and @ambv, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker f029e8db626ddc6e3a3beea4eff511a71aaceb5c 3.13

miss-islington-app bot commented Oct 31, 2025

Sorry, @serhiy-storchaka and @ambv, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker f029e8db626ddc6e3a3beea4eff511a71aaceb5c 3.12

miss-islington-app bot commented Oct 31, 2025

Sorry, @serhiy-storchaka and @ambv, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker f029e8db626ddc6e3a3beea4eff511a71aaceb5c 3.11

miss-islington-app bot commented Oct 31, 2025

Sorry, @serhiy-storchaka and @ambv, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker f029e8db626ddc6e3a3beea4eff511a71aaceb5c 3.10

miss-islington-app bot commented Oct 31, 2025

Sorry, @serhiy-storchaka and @ambv, I could not cleanly backport this to 3.9 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker f029e8db626ddc6e3a3beea4eff511a71aaceb5c 3.9

ambv added a commit to ambv/cpython that referenced this pull request


          [3.9] pythongh-136065: Fix quadratic complexity in os.path.expandvars…

8b8e68d

…() (pythonGH-134952)

(cherry picked from commit f029e8d)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Łukasz Langa <lukasz@langa.pl>

bedevere-app bot commented Oct 31, 2025

GH-140839 is a backport of this pull request to the 3.9 branch.

bedevere-app bot removed the needs backport to 3.9 label

ambv added a commit that referenced this pull request


          [3.9] gh-136065: Fix quadratic complexity in os.path.expandvars() (GH…

2e6150a

…-134952) (GH-140839)

(cherry picked from commit f029e8d)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Łukasz Langa <lukasz@langa.pl>

ambv added a commit to ambv/cpython that referenced this pull request


          [3.14] pythongh-136065: Fix quadratic complexity in os.path.expandvar…

5c0bf52

…s() (pythonGH-134952)

(cherry picked from commit f029e8d)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Łukasz Langa <lukasz@langa.pl>

bedevere-app bot commented Oct 31, 2025

GH-140844 is a backport of this pull request to the 3.14 branch.

bedevere-app bot removed the needs backport to 3.14 label

ambv added a commit to ambv/cpython that referenced this pull request


          [3.13] pythongh-136065: Fix quadratic complexity in os.path.expandvar…

4fc2109

…s() (pythonGH-134952)

(cherry picked from commit f029e8d)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Łukasz Langa <lukasz@langa.pl>

bedevere-app bot commented Oct 31, 2025

GH-140845 is a backport of this pull request to the 3.13 branch.

bedevere-app bot removed the needs backport to 3.13 label

ambv added a commit to ambv/cpython that referenced this pull request


          [3.12] pythongh-136065: Fix quadratic complexity in os.path.expandvar…

122a417

…s() (pythonGH-134952)

(cherry picked from commit f029e8d)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Łukasz Langa <lukasz@langa.pl>

bedevere-app bot commented Oct 31, 2025

GH-140847 is a backport of this pull request to the 3.12 branch.

bedevere-app bot removed the needs backport to 3.12 label

ambv added a commit to ambv/cpython that referenced this pull request


          [3.11] pythongh-136065: Fix quadratic complexity in os.path.expandvar…

e717839

…s() (pythonGH-134952)

(cherry picked from commit f029e8d)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Łukasz Langa <lukasz@langa.pl>

bedevere-app bot commented Oct 31, 2025

GH-140848 is a backport of this pull request to the 3.11 branch.

bedevere-app bot removed the needs backport to 3.11 label

ambv added a commit to ambv/cpython that referenced this pull request


          [3.10] pythongh-136065: Fix quadratic complexity in os.path.expandvar…

…s() (pythonGH-134952)

(cherry picked from commit f029e8d)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Łukasz Langa <lukasz@langa.pl>

bedevere-app bot commented Oct 31, 2025

GH-140851 is a backport of this pull request to the 3.10 branch.

bedevere-app bot removed the needs backport to 3.10 label

ambv added a commit that referenced this pull request


          [3.14] gh-136065: Fix quadratic complexity in os.path.expandvars() (G…

631ba34

…H-134952) (GH-140844)

(cherry picked from commit f029e8d)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

ambv added a commit that referenced this pull request


          [3.12] gh-136065: Fix quadratic complexity in os.path.expandvars() (G…

c8a5f34

…H-134952) (GH-140847)

(cherry picked from commit f029e8d)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Łukasz Langa <lukasz@langa.pl>

ambv added a commit that referenced this pull request


          [3.10] gh-136065: Fix quadratic complexity in os.path.expandvars() (G…

892747b

…H-134952) (GH-140851)

(cherry picked from commit f029e8d)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

ambv added a commit that referenced this pull request


          [3.13] gh-136065: Fix quadratic complexity in os.path.expandvars() (G…

9ab89c0

…H-134952) (GH-140845)

(cherry picked from commit f029e8d)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Łukasz Langa <lukasz@langa.pl>

ambv added a commit that referenced this pull request


          [3.11] gh-136065: Fix quadratic complexity in os.path.expandvars() (G…

5dceb93

…H-134952) (GH-140848)

(cherry picked from commit f029e8d)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

StanFromIreland pushed a commit to StanFromIreland/cpython that referenced this pull request


          pythongh-136065: Fix quadratic complexity in os.path.expandvars() (py…

55c59b3

…thonGH-134952)

Co-authored-by: Łukasz Langa <lukasz@langa.pl>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels