Merge pull request #363 from python/bugfix/361-regexp-perf

Address potential performance weakness in EntryPoint.pattern.

Author: jaraco

CHANGES.rst

@@ -1,3 +1,8 @@
+v4.10.1
+=======
+
+* #361: Avoid potential REDoS in ``EntryPoint.pattern``.
+
 v4.10.0
 =======
 

exercises.py

@@ -34,3 +34,12 @@ def uncached_distribution_perf():
     # end warmup
     importlib.invalidate_caches()
     importlib_metadata.distribution('ipython')
+
+
+def entrypoint_regexp_perf():
+    import importlib_metadata
+    import re
+
+    input = '0' + ' ' * 2 ** 10 + '0'  # end warmup
+
+    re.match(importlib_metadata.EntryPoint.pattern, input)

importlib_metadata/__init__.py

@@ -161,8 +161,8 @@ class EntryPoint(DeprecatedTuple):
 
     pattern = re.compile(
         r'(?P<module>[\w.]+)\s*'
-        r'(:\s*(?P<attr>[\w.]+))?\s*'
-        r'(?P<extras>\[.*\])?\s*$'
+        r'(:\s*(?P<attr>[\w.]+)\s*)?'
+        r'((?P<extras>\[.*\])\s*)?$'
     )
     """
     A regular expression describing the syntax for an entry point,