Skip to content

Commit 221812f

Browse files
committed
fix: replace module-name regex with str.isidentifier per-segment
Semgrep flagged the compiled regex as a potential ReDoS pattern. Validating each dotted segment with str.isidentifier gives the same guarantee against shell/path payloads without any regex, removing the heuristic warning and reading more directly.
1 parent 9a35074 commit 221812f

1 file changed

Lines changed: 3 additions & 4 deletions

File tree

je_mail_thunder/utils/package_manager/package_manager_class.py

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,14 @@
1-
import re
21
from importlib import import_module
32
from importlib.util import find_spec
43
from inspect import getmembers, isfunction, isbuiltin, isclass
54

65
from je_mail_thunder.utils.logging.loggin_instance import mail_thunder_logger
76

8-
_MODULE_NAME_PATTERN = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)*$")
9-
107

118
def _is_safe_module_name(package: str) -> bool:
12-
return isinstance(package, str) and bool(_MODULE_NAME_PATTERN.fullmatch(package))
9+
if not isinstance(package, str) or not package:
10+
return False
11+
return all(part.isidentifier() for part in package.split("."))
1312

1413

1514
class PackageManager:

0 commit comments

Comments
 (0)