From 09fbabf705b588759f295b8e0d5dcca2e886f0db Mon Sep 17 00:00:00 2001
From: catborise <catborise@gmail.com>
Date: Tue, 6 Oct 2026 08:00:57 +0300
Subject: [PATCH] fix(storages): the pool target check runs in linear time

The expression that checks a storage pool's target directory nested a
repetition inside another, so a crafted target backtracked
exponentially: "," followed by 22 dashes and "!" took 1.3 s, and every
two more characters four times as long. The field allows 100
characters, so one form post could hold a worker for good (CodeQL
py/redos; the page is for superusers).

The new expression has no nested repetition and accepts exactly the
same targets: compared with the old one on 200,000 random strings over
letters, digits, "/", ".", "-", "_", ",", "!", space and newline, they
agree on every string. A crafted 100-character target is now checked
in microseconds. The tests pin the accepted and refused targets and
time the crafted one.
---
 storages/forms.py            |  5 ++++-
 storages/test_pool_target.py | 33 +++++++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+), 1 deletion(-)
 create mode 100644 storages/test_pool_target.py

diff --git a/storages/forms.py b/storages/forms.py
index 9a5fadee..4025d0e1 100644
--- a/storages/forms.py
+++ b/storages/forms.py
@@ -38,7 +38,10 @@ class AddStgPool(forms.Form):
     def clean_target(self):
         storage_type = self.cleaned_data["stg_type"]
         target = self.cleaned_data["target"]
-        have_symbol = re.match(r"^[^-](\/?((?:[0-9a-zA-Z_])|(?:\.)|((?<!\/)-))*)+$", target)
+        # letters, digits, "_", ".", "/" and "-" not right after "/"; not
+        # starting with "-". Written without nested repetition, which
+        # backtracked exponentially on crafted input.
+        have_symbol = re.match(r"^[^-](?:[/0-9a-zA-Z_.]|(?<!/)-)*$", target)
         if storage_type in ["dir", "netfs"] and not have_symbol:
             raise forms.ValidationError(
                 _("The target must not contain any special characters")
diff --git a/storages/test_pool_target.py b/storages/test_pool_target.py
new file mode 100644
index 00000000..207dcb06
--- /dev/null
+++ b/storages/test_pool_target.py
@@ -0,0 +1,33 @@
+"""The storage pool target check runs in linear time and accepts what it did."""
+
+import time
+
+from django.test import SimpleTestCase
+from storages.forms import AddStgPool
+
+
+def target_error(target):
+    form = AddStgPool({"name": "pool1", "stg_type": "dir", "target": target})
+    form.is_valid()
+    return "target" in form.errors
+
+
+class PoolTargetTests(SimpleTestCase):
+    def test_accepted_and_refused_targets(self):
+        for target, refused in (
+            ("/var/lib/libvirt/images", False),
+            ("/srv/iso-pool", False),
+            ("/a//b", False),
+            ("a-b.c_d/e", False),
+            ("/a/-b", True),  # a dash right after a slash
+            ("-x", True),
+            ("/a b", True),
+        ):
+            with self.subTest(target=target):
+                self.assertEqual(target_error(target), refused)
+
+    def test_a_crafted_target_is_checked_at_once(self):
+        # the previous expression backtracked exponentially: 22 dashes took over a second
+        start = time.monotonic()
+        self.assertTrue(target_error("," + "-" * 98 + "!"))
+        self.assertLess(time.monotonic() - start, 1)