diff --git a/CVE-2026-18503-3.11-gh-98820-Fix-quadratic-time-in-csv.Sniffer.patch b/CVE-2026-18503-3.11-gh-98820-Fix-quadratic-time-in-csv.Sniffer.patch new file mode 100644 index 0000000000000000000000000000000000000000..07c64e7264dbf60e65e3f923d2fcc37fb123fe9e --- /dev/null +++ b/CVE-2026-18503-3.11-gh-98820-Fix-quadratic-time-in-csv.Sniffer.patch @@ -0,0 +1,69 @@ +From 063d4555c94ef412c731527dbf30193327f2ee82 Mon Sep 17 00:00:00 2001 +From: Serhiy Storchaka +Date: Tue, 4 Aug 2026 13:15:52 +0300 +Subject: [PATCH] [3.12] gh-98820: Fix quadratic time in csv.Sniffer for quoted + fields (GH-154867) (#155166) + +(cherry picked from commit b30c7fa9edd921a118f286e9f90f560777fa693b) + +Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> +Adapted-by: PkgAgent/deepseek-v4 (modified to adapt to opencloudos-stream) +--- + Lib/csv.py | 14 +++++++++----- + Lib/test/test_csv.py | 7 +++++++ + .../2026-07-29-11-20-00.gh-issue-98820.Qm7Hs4.rst | 2 ++ + 3 files changed, 18 insertions(+), 5 deletions(-) + create mode 100644 Misc/NEWS.d/next/Library/2026-07-29-11-20-00.gh-issue-98820.Qm7Hs4.rst + +diff --git a/Lib/csv.py b/Lib/csv.py +index bb3ee26..3e33fce 100644 +--- a/Lib/csv.py ++++ b/Lib/csv.py +@@ -213,12 +213,16 @@ class Sniffer: + this way. + """ + ++ # The body of a quoted field ends at the first quote which is ++ # not doubled, as it does for a reader. A lazy ".*?" scans to ++ # the end of the sample instead, from every start: quadratically. ++ body = r'(?:(?P=quote){2}|(?!(?P=quote)).)*+' + matches = [] +- for restr in (r'(?P[^\w\n"\'])(?P ?)(?P["\']).*?(?P=quote)(?P=delim)', # ,".*?", +- r'(?:^|\n)(?P["\']).*?(?P=quote)(?P[^\w\n"\'])(?P ?)', # ".*?", +- r'(?P[^\w\n"\'])(?P ?)(?P["\']).*?(?P=quote)(?:$|\n)', # ,".*?" +- r'(?:^|\n)(?P["\']).*?(?P=quote)(?:$|\n)'): # ".*?" (no delim, no space) +- regexp = re.compile(restr, re.DOTALL | re.MULTILINE) ++ for restr in (r'(?P[^\w\n"\'])(?P ?)(?P["\'])%s(?P=quote)(?P=delim)', # ,"...", ++ r'(?:^|\n)(?P["\'])%s(?P=quote)(?P[^\w\n"\'])(?P ?)', # "...", ++ r'(?P[^\w\n"\'])(?P ?)(?P["\'])%s(?P=quote)(?:$|\n)', # ,"..." ++ r'(?:^|\n)(?P["\'])%s(?P=quote)(?:$|\n)'): # "..." (no delim, no space) ++ regexp = re.compile(restr % body, re.DOTALL | re.MULTILINE) + matches = regexp.findall(data) + if matches: + break +diff --git a/Lib/test/test_csv.py b/Lib/test/test_csv.py +index 05653a2..86939cf 100644 +--- a/Lib/test/test_csv.py ++++ b/Lib/test/test_csv.py +@@ -1234,6 +1234,13 @@ ghi\0jkl + dialect = sniffer.sniff(self.sample9) + self.assertTrue(dialect.doublequote) + ++ def test_sniff_quoted_single_column(self): ++ # gh-98820: this sample used to take minutes. ++ sniffer = csv.Sniffer() ++ sample = '"abcdefghijklmnopqrstuvwxyz"\n' * 10000 ++ with self.assertRaisesRegex(csv.Error, "Could not determine delimiter"): ++ sniffer.sniff(sample, delimiters=',:|\t') ++ + class NUL: + def write(s, *args): + pass +diff --git a/Misc/NEWS.d/next/Library/2026-07-29-11-20-00.gh-issue-98820.Qm7Hs4.rst b/Misc/NEWS.d/next/Library/2026-07-29-11-20-00.gh-issue-98820.Qm7Hs4.rst +new file mode 100644 +index 0000000..aa9ae8d +--- /dev/null ++++ b/Misc/NEWS.d/next/Library/2026-07-29-11-20-00.gh-issue-98820.Qm7Hs4.rst +@@ -0,0 +1,2 @@ ++Fix quadratic time in :meth:`csv.Sniffer.sniff` for a sample which contains ++quoted fields, in particular for a single column of quoted fields. diff --git a/python3.11.spec b/python3.11.spec index 4a62f197f2912ffc0381bbe187494af0cd0daa22..09af0d2d9ce54bf2e52b837cf5f068d440bef875 100644 --- a/python3.11.spec +++ b/python3.11.spec @@ -129,7 +129,8 @@ Patch0048: CVE-2026-0672-3.11-gh-143919-Reject-control-characters-in-http-coo.pa Patch0049: 0001-3.11-gh-114331-Skip-decimal-test_maxcontext_exact_ar.patch Patch0050: CVE-2026-0865-3.11-gh-143916-Reject-control-characters-in-wsgiref..patch Patch0051: CVE-2026-1299-3.11-gh-144125-email-verify-headers-are-sound-in-Byt.patch -Patch0052: CVE-2026-11940.patch +Patch0052: CVE-2026-18503-3.11-gh-98820-Fix-quadratic-time-in-csv.Sniffer.patch +Patch0053: CVE-2026-11940.patch Patch3000: 00001-rpath.patch Patch3001: 00251-change-user-install-location.patch @@ -1163,10 +1164,14 @@ LD_LIBRARY_PATH=$(pwd)/normal $(pwd)/normal/python -m test.regrtest \ %endif %changelog -* Wed Aug 12 2026 PkgAgent Robot - 3.11.6-31 +* Wed Aug 12 2026 PkgAgent Robot - 3.11.6-32 - [Type] security - [DESC] Fix CVE-2026-11940: tarfile data/tar extraction filter symlink escape via hardlink fallback +* Tue Aug 11 2026 PkgAgent Robot - 3.11.6-31 +- [Type] security +- [DESC] Fix CVE-2026-18503: quadratic time in csv.Sniffer.sniff for quoted fields + * Tue Mar 3 2026 Shuo Wang - 3.11.6-30 - fix CVE-2026-1299 - gh-144125: email: verify headers are sound in BytesGenerator