Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

[Bug]: Overly permissive regular expression range

未关闭
#734 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
2/5
预计耗时
1-3 小时
新手友好度
45/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
停滞
技术栈
python
领域
cli, security

调研方向

该 issue 指向 tests/integration/stackscripts/test_stackscripts.py 第 95 行；检查其中的正则表达式及其现有覆盖范围。确认字符范围只接受预期的字符，更新相关测试或表达式，并运行关联的集成测试。

由索引模型根据 Issue 内容生成。

描述

bug
CLI Version

v5.56.2

Command

https://github.com/linode/linode-cli/blob/fafe73e1f48a48ab9cbdf9b01f679e041f6bf3fa/tests/integration/stackscripts/test_stackscripts.py#L95-L95

It's easy to write a regular expression range that matches a wider range of characters than you intended. /[a-zA-z]/ matches all lowercase and all uppercase letters, as you would expect, but it also matches the characters: `[ \ ] ^ _ ``.

Another common problem is failing to escape the dash character in a regular expression. An unescaped dash is interpreted as part of a range. For example, in the character class [a-zA-Z0-9%=.,-_] the last character range matches the 55 characters between , and _ (both included), which overlaps with the range [0-9] and is clearly not intended by the writer.

Output

No response

Expected Behavior

[CWE-20

Actual Behavior

Improper Neutralization of Special Elements used in a Command in Shell-quote
Exploiting CVE-2021-42740
no-obscure-range
The regex [,-.]
CWE-20.

Steps to Reproduce

POC

The following code is intended to check whether a string is a valid 6 digit hex color.

import re
def is_valid_hex_color(color):
    return re.match(r'^#[0-9a-fA-f]{6}$', color) is not None

However, the A-f range is overly large and matches every uppercase character. It would parse a "color" like #XXYYZZ as valid.

The fix is to use an uppercase A-F range instead.

import re
def is_valid_hex_color(color):
    return re.match(r'^#[0-9a-fA-F]{6}$', color) is not None

Recommendation

Avoid any confusion about which characters are included in the range by writing unambiguous regular expressions. Always check that character ranges match only the expected characters.

主要语言
Python
星标
442
派生
159
平均合并
7 天 21 小时
30 天内合并 PR
8

贡献指南

打开贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

linode/linode-cli 的其他 Issue

查看 linode/linode-cli 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。