From b4a39d9850969b4e1d6940d32094ee0b42a2cf03 Mon Sep 17 00:00:00 2001 From: Andi Albrecht Date: Sat, 13 Apr 2024 13:59:00 +0200 Subject: [PATCH] Raise SQLParseError instead of RecursionError. CVE: CVE-2024-4340 Upstream-Status: Backport [https://github.com/andialbrecht/sqlparse/commit/b4a39d9850969b4e1d6940d32094ee0b42a2cf03] Signed-off-by: Soumya Sambu --- sqlparse/sql.py | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/sqlparse/sql.py b/sqlparse/sql.py index 6a32c26..ffffc77 100644 --- a/sqlparse/sql.py +++ b/sqlparse/sql.py @@ -10,6 +10,7 @@ import re from sqlparse import tokens as T +from sqlparse.exceptions import SQLParseError from sqlparse.utils import imt, remove_quotes @@ -209,11 +210,14 @@ class TokenList(Token): This method is recursively called for all child tokens. """ - for token in self.tokens: - if token.is_group: - yield from token.flatten() - else: - yield token + try: + for token in self.tokens: + if token.is_group: + yield from token.flatten() + else: + yield token + except RecursionError as err: + raise SQLParseError('Maximum recursion depth exceeded') from err def get_sublists(self): for token in self.tokens: -- 2.40.0