Discussion:
[Trac-dev] Maximum recursion depth issue in rendering templates
Richard Liao
2008-08-24 01:59:03 UTC
Permalink
Hi all.

I have met a trac crash when I was trying to create new ticket or
access admin pages.
The trac crashes hardly with error: "segmentation fault" in my FreeBSD box.
After some digging, I found the problem lays in genshi's transform module.

The following is a test script to reproduce that hard crashe by
setting recursion limit exceeds the platform's capabilities:

import sys
from genshi.input import HTML
from genshi.builder import tag
from genshi.filters.transform import Transformer
sys.setrecursionlimit(1000 * 20)
stream = HTML('<html><head><title>Some Title</title></head>'
'<body>Some <em>body</em> text.</body></html>')
for i in xrange(1000 * 10):
stream = stream | Transformer('body').prepend(tag.h1('Document Title'))
print stream.render()

If comment out setrecursionlimit line to use system default recursion
limit, it raises exception: "RuntimeError: maximum recursion depth
exceeded".

File ".../genshi/filters/transform.py", line 686, in _unmark
for mark, event in stream:
File ".../genshi/filters/transform.py", line 1129, in __call__
for mark, event in stream:
File ".../genshi/filters/transform.py", line 713, in __call__
for mark, event in stream:
File ".../genshi/filters/transform.py", line 682, in _mark
for event in stream:
File ".../genshi/core.py", line 267, in _ensure
event = stream.next()
File ".../genshi/filters/transform.py", line 686, in _unmark
for mark, event in stream:
File ".../genshi/filters/transform.py", line 1129, in __call__
for mark, event in stream:
File ".../genshi/filters/transform.py", line 713, in __call__
for mark, event in stream:
File ".../genshi/filters/transform.py", line 682, in _mark
for event in stream:
File ".../genshi/core.py", line 267, in _ensure
event = stream.next()
...

The problem is that the transform module is in very deep and unlimited
recursion.

I think it's a problem in genshi, maybe also in trac?

I am not sure why trac crashes siliently with no exception raised
after I searched trac source codes but can't find any lines about
setrecursionlimit.

Has anyone got the same situation?

Regards,

--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups "Trac Development" group.
To post to this group, send email to trac-***@googlegroups.com
To unsubscribe from this group, send email to trac-dev+***@googlegroups.com
For more options, visit this group at http://groups.google.com/group/trac-dev?hl=en
-~----------~----~----~----~------~----~------~--~---
Richard Liao
2008-09-01 13:12:12 UTC
Permalink
I searched days ago, and think we need do something to this problem,
because this can be a serious security problem in some circumstances.
Think of that someone trigger this function by adding a very long
template, the server will die siliently.
Post by Richard Liao
Hi all.
I have met a trac crash when I was trying to create new ticket or
access admin pages.
The trac crashes hardly with error: "segmentation fault" in my FreeBSD box.
After some digging, I found the problem lays in genshi's transform module.
The following is a test script to reproduce that hard crashe by
import sys
from genshi.input import HTML
from genshi.builder import tag
from genshi.filters.transform import Transformer
sys.setrecursionlimit(1000 * 20)
stream = HTML('<html><head><title>Some Title</title></head>'
'<body>Some <em>body</em> text.</body></html>')
stream = stream | Transformer('body').prepend(tag.h1('Document Title'))
print stream.render()
If comment out setrecursionlimit line to use system default recursion
limit, it raises exception: "RuntimeError: maximum recursion depth
exceeded".
File ".../genshi/filters/transform.py", line 686, in _unmark
File ".../genshi/filters/transform.py", line 1129, in __call__
File ".../genshi/filters/transform.py", line 713, in __call__
File ".../genshi/filters/transform.py", line 682, in _mark
File ".../genshi/core.py", line 267, in _ensure
event = stream.next()
File ".../genshi/filters/transform.py", line 686, in _unmark
File ".../genshi/filters/transform.py", line 1129, in __call__
File ".../genshi/filters/transform.py", line 713, in __call__
File ".../genshi/filters/transform.py", line 682, in _mark
File ".../genshi/core.py", line 267, in _ensure
event = stream.next()
...
The problem is that the transform module is in very deep and unlimited
recursion.
I think it's a problem in genshi, maybe also in trac?
I am not sure why trac crashes siliently with no exception raised
after I searched trac source codes but can't find any lines about
setrecursionlimit.
Has anyone got the same situation?
Regards,
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups "Trac Development" group.
To post to this group, send email to trac-***@googlegroups.com
To unsubscribe from this group, send email to trac-dev+***@googlegroups.com
For more options, visit this group at http://groups.google.com/group/trac-dev?hl=en
-~----------~----~----~----~------~----~------~--~---
Noah Kantrowitz
2008-09-01 16:14:19 UTC
Permalink
Post by Richard Liao
I searched days ago, and think we need do something to this problem,
because this can be a serious security problem in some circumstances.
Think of that someone trigger this function by adding a very long
template, the server will die siliently.
Don't throw around the term "security issue" unless you can back it up.
This is at worst an annoyance, however I don't know of any way to
exploit it remotely or do anything worse than DoS the server should the
admin leave a broken page up.

This is also not a Trac issue, it is a design problem in Genshi. The
simple solution is stop nesting filters so deeply.

--Noah
RjOllos
2015-07-15 23:31:45 UTC
Permalink
Post by Noah Kantrowitz
Post by Richard Liao
I searched days ago, and think we need do something to this problem,
because this can be a serious security problem in some circumstances.
Think of that someone trigger this function by adding a very long
template, the server will die siliently.
Don't throw around the term "security issue" unless you can back it up.
This is at worst an annoyance, however I don't know of any way to
exploit it remotely or do anything worse than DoS the server should the
admin leave a broken page up.
This is also not a Trac issue, it is a design problem in Genshi. The
simple solution is stop nesting filters so deeply.
--Noah
After reading the comments here and in (1), with my limited knowledge of
Genshi I implemented a workaround for the same issue in (2). I'm interested
to know if anyone has an idea of a better way to append a column to a long
table using Genshi. I might just switch to a JavaScript implementation.

(1) https://groups.google.com/d/msg/genshi/foqJpReEcUo/VOvd-_cibLIJ
(2) https://trac-hacks.org/ticket/12198#comment:3
--
You received this message because you are subscribed to the Google Groups "Trac Development" group.
To unsubscribe from this group and stop receiving emails from it, send an email to trac-dev+***@googlegroups.com.
To post to this group, send email to trac-***@googlegroups.com.
Visit this group at http://groups.google.com/group/trac-dev.
For more options, visit https://groups.google.com/d/optout.
Loading...