1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
|
From: joshuamorton <joshuamorton@google.com>
Date: Wed, 21 May 2025 20:53:40 +0000
Subject: [PATCH] Sort paths longest to shortest.
Previously, path sort length was inverted, with short paths before long
ones, this led to a path like `/*` being handled *before* a path like
`/foo/bar/baz`, which is exactly what we didn't want. This was tested,
but the test was misnamed and so wasn't picked up by pytest.
Reviewed-By: Daniel Leidert <dleidert@debian.org>
Origin: https://github.com/corydolphin/flask-cors/pull/392
Bug: https://github.com/corydolphin/flask-cors/pull/391
Bug-Debian: https://bugs.debian.org/1100988
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2024-6839
Bug-Freexian-Security: https://deb.freexian.com/extended-lts/tracker/CVE-2024-6839
---
flask_cors/core.py | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/flask_cors/core.py b/flask_cors/core.py
index a3d2809..cbf123a 100644
--- a/flask_cors/core.py
+++ b/flask_cors/core.py
@@ -73,11 +73,11 @@ def parse_resources(resources):
def sort_key(pair):
pattern, _ = pair
if isinstance(pattern, RegexObject):
- return (1, 0, pattern.pattern.count("/"), -len(pattern.pattern))
+ return (1, 0, -pattern.pattern.count("/"), -len(pattern.pattern))
elif probably_regex(pattern):
- return (1, 1, pattern.count("/"), -len(pattern))
+ return (1, 1, -pattern.count("/"), -len(pattern))
else:
- return (0, 0, pattern.count("/"), -len(pattern))
+ return (0, 0, -pattern.count("/"), -len(pattern))
return sorted(resources, key=sort_key)
|
