chanop.py: freezes when using excess wildcards

[jlu5]

Something like /mode #channel +b *!*@************ can freeze WeeChat entirely at 100% CPU usage.

I'm not sure if this issue is remotely exploitable (I'm thinking that the Affects: whoever is only displayed when you're (un)setting a ban).

Using WeeChat 1.1.1 and chanop.py 0.3.1.

[Mikaela]

I'm not sure if this issue is remotely exploitable (I'm thinking that the Affects: whoever is only displayed when you're (un)setting a ban).

This is remotely exploitable as Affects: whoever is displayed on every channel that you have in plugins.var.python.chanop.watchlist.<NETWORK>. That variable is appended always when you run /o<command> on any channel. There is also issue https://github.com/weechat/scripts/issues/35 even if it's not implemented yet.

[jlu5]

Ping @m4v since they seem to be the creator of the script?

[Mikaela]

I think @m4v has said that they don't update or write WeeChat scripts anymore.

[m4v]

this is probably a regex matching taking exponential time to return. I can think two ways of solving this, sanitizing the input pattern or creating a subprocess for solve the regex and kill it if it takes too long. Sanitizing the input would be the most easy to implement I think.

I think @m4v has said that they don't update or write WeeChat scripts anymore.

Several occasions I meant to do some updates but lately I'm getting easily distracted by other stuff :P

[SamStrongTalks]

If no one else is working on this, I can take a shot at it.