Inefficient regex in `extract_full_summary_from_signature`

[jiasli]

As pointed out by https://gist.github.com/prodigysml/d07cd482214c80bfb6d3240454d2f679, this regex (introduced by 430c39e, #8) is inefficient:

knack/knack/introspection.py

Line 18 in e0c1411

regex = r'\s*(:param)\s+(.+?)\s*:(.*)'

It tries to match a string such as:

        :param command_loader: The command loader that commands will be registered into

As shown in https://regex101.com/, a simple :param r requires 1214 steps to fail.

:param r causes catastrophic backtracking:

This is because \s+, .+? and \s* all match consecutive spaces, thus can trigger many backtrackings.

A better solution is to replace .+? with \w+ to match the parameter name so that backtrackings can be greatly reduced:

\s*(:param)\s+(\w+)\s*:(.*)

[carnil]

This seems to be the issue described by CVE-2025-54363 and CVE-2025-54364.

[jiasli]

This seems to be the issue described by CVE-2025-54363 and CVE-2025-54364.

These CVEs are invalid. Knack is a CLI framework used by Azure CLI. It's a local library, not a web service. In addition, the regex is used to extract function and parameter docstrings from the source code. It is not used to match user input. Therefore, it does not expose any attack surface. There is no way to use it for ReDoS attack.

[jiasli]

\s*(:param)\s+(\w+)\s*:(.*) cannot match docstrings that has type info such as float in it:

        :param float size_kb: specify the generated file size in kb.

I first think of \s*(:param)(.*)\s(\w+):(.*), but it still requires backtracking:

\s*(:param)\s+([^:]+):(.*) looks promising:

Simple string operation such as split can also be used to fully eliminate backtracking.

Therefore, changing it may not be easy. The regex is widely used by Azure CLI's help message and document generation. Changing it needs thorough testing and adding more arguments in

knack/tests/test_introspection.py

Lines 11 to 15 in 6c07fe7

	def op1(self, arg1, arg2=False, arg3='mydefaultvalue', **kwargs): # pylint: disable=unused-argument
	""" This is the command description.
	:param arg3: This is an arg for a test.
	"""
	pass

such as

     :param int arg4: This is an integer arg for a test.