CVE-2023-30608 Hand-Cherry-Pick a fix c457abd

From:
andialbrecht@c457abd

CHANGELOG

@@ -1,3 +1,20 @@
+Release 0.3.1.1 (May 9, 2024)
+----------------------------
+
+Notable Changes
+
+* IMPORTANT: This release fixes a security vulnerability in the
+  parser where a regular expression vulnerable to ReDOS (Regular
+  Expression Denial of Service) was used. See the security advisory
+  for details: https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2
+  The vulnerability was discovered by @erik-krogh from GitHub
+  Security Lab (GHSL). Thanks for reporting!
+
+
+Bug Fixes
+
+* Fix regular expressions for string parsing.
+
 Release 0.3.1 (Feb 29, 2020)
 ----------------------------
 

sqlparse/keywords.py

@@ -67,9 +67,9 @@ def is_keyword(value):
         (r'(?![_A-ZÀ-Ü])-?(\d+(\.\d*)|\.\d+)(?![_A-ZÀ-Ü])',
          tokens.Number.Float),
         (r'(?![_A-ZÀ-Ü])-?\d+(?![_A-ZÀ-Ü])', tokens.Number.Integer),
-        (r"'(''|\\\\|\\'|[^'])*'", tokens.String.Single),
+        (r"'(''|\\'|[^'])*'", tokens.String.Single),
         # not a real string literal in ANSI SQL:
-        (r'"(""|\\\\|\\"|[^"])*"', tokens.String.Symbol),
+        (r'"(""|\\"|[^"])*"', tokens.String.Symbol),
         (r'(""|".*?[^\\]")', tokens.String.Symbol),
         # sqlite names can be escaped with [square brackets]. left bracket
         # cannot be preceded by word character or a right bracket --

tests/test_split.py

@@ -20,9 +20,8 @@ def test_split_semicolon():
 
 
 def test_split_backslash():
-    stmts = sqlparse.parse(r"select '\\'; select '\''; select '\\\'';")
-    assert len(stmts) == 3
-
+    stmts = sqlparse.parse("select '\'; select '\'';")
+    assert len(stmts) == 2
 
 @pytest.mark.parametrize('fn', ['function.sql',
                                 'function_psql.sql',