From 3ee721345d23b4818aac81602934b87eb9a494b6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Tue, 6 Sep 2016 09:03:11 +0200
Subject: [PATCH] Remove IDENTIFIER regexp on ir.model and ir.model.field

This regexp has all the factors for ReDoS so it is safer to remove it even if
only administrators can create the records.

issue5743
review29481002
---
 CHANGELOG           |  1 +
 trytond/ir/model.py | 38 --------------------------------------
 2 files changed, 1 insertion(+), 38 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 60c8b5b15e..391065ef77 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,4 @@
+* Remove IDENTIFIER regexp on ir.model and ir.model.field
 * Enforce suffix and prefix to have id or name
 * Sanitize path in file_open (CVE-2016-1242)
 * Prevent read of user password hash (CVE-2016-1241)
diff --git a/trytond/ir/model.py b/trytond/ir/model.py
index ad15fdb177..d6a710a04d 100644
--- a/trytond/ir/model.py
+++ b/trytond/ir/model.py
@@ -34,8 +34,6 @@ __all__ = [
     'ModelWorkflowGraph',
     ]
 
-IDENTIFIER = re.compile(r'^[a-zA-z_][a-zA-Z0-9_]*$')
-
 
 class Model(ModelSQL, ModelView):
     "Model"
@@ -70,10 +68,6 @@ class Model(ModelSQL, ModelView):
             ('model_uniq', Unique(table, table.model),
                 'The model must be unique!'),
             ]
-        cls._error_messages.update({
-                'invalid_module': ('Module name "%s" is not a valid python '
-                    'identifier.'),
-                })
         cls._order.insert(0, ('model', 'ASC'))
         cls.__rpc__.update({
                 'list_models': RPC(),
@@ -114,20 +108,6 @@ class Model(ModelSQL, ModelView):
                     where=ir_model.id == model_id))
         return model_id
 
-    @classmethod
-    def validate(cls, models):
-        super(Model, cls).validate(models)
-        cls.check_module(models)
-
-    @classmethod
-    def check_module(cls, models):
-        '''
-        Check module
-        '''
-        for model in models:
-            if model.module and not IDENTIFIER.match(model.module):
-                cls.raise_user_error('invalid_module', (model.rec_name,))
-
     @classmethod
     def list_models(cls):
         'Return a list of all models names'
@@ -256,10 +236,6 @@ class ModelField(ModelSQL, ModelView):
             ('name_model_uniq', Unique(table, table.name, table.model),
                 'The field name in model must be unique!'),
             ]
-        cls._error_messages.update({
-                'invalid_name': ('Model Field name "%s" is not a valid python '
-                    'identifier.'),
-                })
         cls._order.insert(0, ('name', 'ASC'))
 
     @classmethod
@@ -329,20 +305,6 @@ class ModelField(ModelSQL, ModelView):
     def default_field_description():
         return 'No description available'
 
-    @classmethod
-    def validate(cls, fields):
-        super(ModelField, cls).validate(fields)
-        cls.check_name(fields)
-
-    @classmethod
-    def check_name(cls, fields):
-        '''
-        Check name
-        '''
-        for field in fields:
-            if not IDENTIFIER.match(field.name):
-                cls.raise_user_error('invalid_name', (field.name,))
-
     @classmethod
     def read(cls, ids, fields_names=None):
         pool = Pool()