Index | Thread | Search

From:
Stuart Henderson <stu@spacehopper.org>
Subject:
p5-String-Util 1.36 (fixes regex DoS)
To:
Wen Heping <wenheping2000@hotmail.com>
Cc:
ports <ports@openbsd.org>
Date:
Wed, 8 Jul 2026 12:07:17 +0100

Download raw body.

Thread
ok to update?

"The trim and rtrim functions stripped trailing whitespace with
s/\s*$//u. Because \s* matches greedily and the $ anchor fails whenever
a non-whitespace character follows the whitespace, the regex engine
retries the match at each offset of a long whitespace run, producing
quadratic backtracking. The fix replaces \s*$ with \s+$.

Any caller that passes untrusted input to trim or rtrim can trigger CPU
exhaustion with a string containing a long run of whitespace."

Index: Makefile
===================================================================
RCS file: /cvs/ports/textproc/p5-String-Util/Makefile,v
diff -u -p -r1.2 Makefile
--- Makefile	5 Sep 2024 02:53:43 -0000	1.2
+++ Makefile	8 Jul 2026 11:07:09 -0000
@@ -1,6 +1,7 @@
 COMMENT =	string processing utility functions
 
-DISTNAME =	String-Util-1.35
+CPAN_AUTHOR =	BAKERSCOT
+DISTNAME =	String-Util-1.36
 
 CATEGORIES =	textproc
 
Index: distinfo
===================================================================
RCS file: /cvs/ports/textproc/p5-String-Util/distinfo,v
diff -u -p -r1.2 distinfo
--- distinfo	5 Sep 2024 02:53:43 -0000	1.2
+++ distinfo	8 Jul 2026 11:07:09 -0000
@@ -1,2 +1,2 @@
-SHA256 (String-Util-1.35.tar.gz) = 4IncSqcUxIAbNZ32VG8mW605LKI4AwnIkA5FtGaLt24=
-SIZE (String-Util-1.35.tar.gz) = 17216
+SHA256 (String-Util-1.36.tar.gz) = UXsasyVm/U1ei+I9mTOc47/+4pEsX/KfXclYcP9Pyw4=
+SIZE (String-Util-1.36.tar.gz) = 19204