From b54290affbd50822f43a04dd50b75d27fef40084 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 4 Feb 2009 15:38:11 -0500
Subject: [PATCH] BF: anchoring regex for IP with " *$" at the end + adjust
 regexp for <HOST>

to forbid matching IPs encoded in the hostname (like
1.2.3.4.xxx.yyyyy.zzz) prior doing actual DNS lookup.

It is quite important and actually security hazard: DoS is easy to
perform...

Since now we don't do \S matching in <HOST> regexp, in the development
branches we should also allow for unicode characters by adding 're.U' to HOST's
regexp
---
 server/failregex.py | 2 +-
 server/filter.py    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/failregex.py b/server/failregex.py
index 8536300b..91778003 100644
--- a/server/failregex.py
+++ b/server/failregex.py
@@ -44,7 +44,7 @@ class Regex:
 		self._matchCache = None
 		# Perform shortcuts expansions.
 		# Replace "<HOST>" with default regular expression for host.
-		regex = regex.replace("<HOST>", "(?:::f{4,6}:)?(?P<host>\S+)")
+		regex = regex.replace("<HOST>", "(?:::f{4,6}:)?(?P<host>[\w\-.^_]+)")
 		if regex.lstrip() == '':
 			raise RegexException("Cannot add empty regex")
 		try:
diff --git a/server/filter.py b/server/filter.py
index 457bb031..6bd27ffd 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -492,7 +492,7 @@ import socket, struct
 
 class DNSUtils:
 	
-	IP_CRE = re.compile("(?:\d{1,3}\.){3}\d{1,3}")
+	IP_CRE = re.compile("(?:\d{1,3}\.){3}\d{1,3}$")
 	
 	#@staticmethod
 	def dnsToIp(dns):