From 223572343678368bac4a3a2bcb5d8cb59a95dc5e Mon Sep 17 00:00:00 2001
From: Keerthana KT <keerthana@labs.digiscrypt.com>
Date: Wed, 30 Sep 2026 13:12:41 +0530
Subject: [PATCH] fix(config): bound option-line parsing

`GitConfigParser.OPTCRE` matched an option line with
`(?P<option>[^:=#;]*)` immediately followed by `\s*(?P<vi>[:=])`. The
option name class and that `\s*` both match spaces, so a line that never
reaches a `:` or `=` separator (a key followed by a long run of
whitespace) makes the regex engine retry every space position, taking
`O(n^2)` time in the length of the run.

Config files are parsed straight from repository content. `.gitmodules`
in particular is read whenever submodules of an inspected or cloned
repository are enumerated, so the line is fully attacker-controlled. A
crafted key line costs about `0.25s` of CPU at 8,000 spaces and roughly
`160s` at 200,000, stalling any caller that reads the config.

The trailing `\s*` is redundant: `[^:=#;]*` already consumes any spaces
up to the indicator, and the captured name is right-stripped after
parsing. Dropping it leaves a single quantifier over the whitespace run,
so matching is linear. The collapsed pattern accepts exactly the same
lines and yields the same groups as the previous one, checked over
200,000 fuzzed inputs with zero differences.

Add `test_option_line_with_long_whitespace_run_is_not_quadratic`, a
CPU-time regression that fails on the previous pattern and passes here,
and that confirms a valid key before the malformed line still parses.
---
 git/config.py       |  6 +++++-
 test/test_config.py | 20 ++++++++++++++++++++
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/git/config.py b/git/config.py
index 9bb82273c..a3437d525 100644
--- a/git/config.py
+++ b/git/config.py
@@ -334,7 +334,11 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder):
 
     OPTVALUEONLY = re.compile(optvalueonly_source)
 
-    OPTCRE = re.compile(optvalueonly_source + r"\s*(?P<vi>[:=])\s*" + r"(?P<value>.*)$")
+    # The option name class [^:=#;]* already consumes any spaces up to the ":" or "=",
+    # so a second \s* before the indicator would overlap it and backtrack quadratically
+    # on a line that never reaches an indicator (for example a key followed by a long
+    # whitespace run). Drop the redundant \s*; the name is right-stripped after parsing.
+    OPTCRE = re.compile(optvalueonly_source + r"(?P<vi>[:=])\s*" + r"(?P<value>.*)$")
 
     del optvalueonly_source
 
diff --git a/test/test_config.py b/test/test_config.py
index b0f7f72eb..274738075 100644
--- a/test/test_config.py
+++ b/test/test_config.py
@@ -9,6 +9,7 @@
 import os.path as osp
 import subprocess
 import sys
+import time
 from unittest import mock
 
 import pytest
@@ -262,6 +263,25 @@ def test_inline_comments_are_stripped_like_git(self):
             with self.subTest(content=content):
                 self.assertEqual(config.get_value("a", "k"), expected)
 
+    def test_option_line_with_long_whitespace_run_is_not_quadratic(self):
+        """A key followed by a long whitespace run and no indicator must not make
+        the option regex backtrack quadratically.
+
+        `.gitmodules` and other config files are fully controlled by any repository
+        that is inspected, so a crafted line must stay cheap to parse. Keys that come
+        before the malformed line are still read.
+        """
+        malformed = b'[submodule "x"]\n\tpath = x\n\tbranch' + b" " * 200_000 + b"\n"
+        config_file = io.BytesIO(malformed)
+        config_file.name = ".gitmodules"
+        config = GitConfigParser(config_file)
+        start = time.process_time()
+        config.read()
+        elapsed = time.process_time() - start
+        # Leave ample CPU time for slow runners, but catch quadratic backtracking.
+        self.assertLess(elapsed, 1.0)
+        self.assertEqual(config.get_value('submodule "x"', "path"), "x")
+
     @with_rw_directory
     def test_inline_comments_preserve_balanced_quotes_and_following_settings(self, rw_dir):
         config_path = osp.join(rw_dir, "config")