Skip to content

Commit

Permalink
Add test capturing failed expectation. Ref #3659.
Browse files Browse the repository at this point in the history
  • Loading branch information
jaraco committed Nov 4, 2022
1 parent 1f97905 commit 5791343
Show file tree
Hide file tree
Showing 3 changed files with 15 additions and 1 deletion.
1 change: 1 addition & 0 deletions setup.cfg
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,7 @@ testing =
pip_run>=8.8
ini2toml[lite]>=0.9
tomli-w>=1.0.0
pytest-timeout

testing-integration =
pytest
Expand Down
6 changes: 5 additions & 1 deletion setuptools/package_index.py
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
"""PyPI and direct package downloading"""
"""PyPI and direct package downloading."""

import sys
import os
import re
Expand Down Expand Up @@ -217,6 +218,9 @@ def wrapper(*args, **kwargs):


REL = re.compile(r"""<([^>]*\srel\s*=\s*['"]?([^'">]+)[^>]*)>""", re.I)
"""
Regex for an HTML tag with 'rel="val"' attributes.
"""


@unique_values
Expand Down
9 changes: 9 additions & 0 deletions setuptools/tests/test_packageindex.py
Original file line number Diff line number Diff line change
Expand Up @@ -305,3 +305,12 @@ def test_percent_in_password(self, temp_home):
cred = cfg.creds_by_repository['https://pypi.org']
assert cred.username == 'jaraco'
assert cred.password == 'pity%'


@pytest.mark.xfail(reason="#3659")
@pytest.mark.timeout(1)
def test_REL_DoS():
"""
REL should not hang on a contrived attack string.
"""
setuptools.package_index.REL.search('< rel=' + ' ' * 2**12)

0 comments on commit 5791343

Please sign in to comment.