gh-134873: Fix a DOS issue in posixpath

[Wulian233]

importtimeimportosimportposixpathimportLib.posixpathasposixpath_fixedos.environ['A'] ='x'payload="$A"*100000print("Payload size:", len(payload)) start=time.time() posixpath.expandvars(payload) print("Original time:", time.time() -start, "seconds") start=time.time() posixpath_fixed.expandvars(payload) print("Fixed time:", time.time() -start, "seconds")

Above is a code that reproduces the problem, and the speed difference becomes more and more noticeable with the number of times. The above 200,000 times is 15x faster

print:

Payload size: 200000 Original time: 1.7329566478729248 seconds Fixed time: 0.11450839042663574 seconds 

• Issue: A Series of Simple DOS Vulnerabilities #134873

[serhiy-storchaka]

There is other quadratic complexity here -- in the regular expression. Example: expandvars('${'*1000000).

Also, using re.sub() is more efficient here. See #134952.

[Wulian233]

Also, using re.sub() is more efficient here. See #134952

#134952 include this fix. What should I do? Should I modify this PR according to your changes or close this PR👀

[serhiy-storchaka]

I suggest to close this PR in favor of #134952, unless the latter has serious flaws. Thank you anyway.

[Wulian233]

No problem