From 24b8aa76c6cd6d70f39c6dd605cce319c98e2ccc Mon Sep 17 00:00:00 2001 From: "zam." Date: Thu, 26 Mar 2026 04:48:59 +0700 Subject: [PATCH] fix(lexers): prevent ReDoS in archetype lexer GUID and ID patterns (#3064) --- pygments/lexers/archetype.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pygments/lexers/archetype.py b/pygments/lexers/archetype.py index 5b3eb21ae7..977b02f751 100644 --- a/pygments/lexers/archetype.py +++ b/pygments/lexers/archetype.py @@ -35,8 +35,8 @@ class AtomsLexer(RegexLexer): (r'([ \t]*)(--.*)$', bygroups(Whitespace, Comment)), ], 'archetype_id': [ - (r'([ \t]*)(([a-zA-Z]\w+(\.[a-zA-Z]\w+)*::)?[a-zA-Z]\w+(-[a-zA-Z]\w+){2}' - r'\.\w+[\w-]*\.v\d+(\.\d+){,2}((-[a-z]+)(\.\d+)?)?)', + (r'([ \t]*)(([a-zA-Z]\w{1,100}(\.[a-zA-Z]\w{1,100})*::)?[a-zA-Z]\w{1,100}(-[a-zA-Z]\w{1,100}){2}' + r'\.\w{1,100}[\w-]*\.v\d+(\.\d+){,2}((-[a-z]+)(\.\d+)?)?)', bygroups(Whitespace, Name.Decorator)), ], 'date_constraints': [ @@ -293,7 +293,7 @@ class AdlLexer(AtomsLexer): # numbers and version ids (r'\d+(\.\d+)*', Literal), # Guids - (r'(\d|[a-fA-F])+(-(\d|[a-fA-F])+){3,}', Literal), + (r'[0-9a-fA-F]{1,36}(-[0-9a-fA-F]{1,36}){3,}', Literal), (r'\w+', Name.Class), (r'"', String, 'string'), (r'=', Operator),