Bundled configobj subject to CVE-2023-26112

[braingram]

configobj is subject to a ReDoS: GHSA-c33w-24p9-8m24

This regex used to parse the config/spec items suffers from catastrophic backtracking:

stpipe/src/stpipe/extern/configobj/validate.py

Line 540 in e82a1f0

_func_re = re.compile(r'(.+?)\((.*)\)', re.DOTALL)

This is one useful write-up on the issue: https://www.regular-expressions.info/catastrophic.html

The upstream/bundled project appears abandoned but does have an open PR that appears to fix the offending regex:
DiffSK/configobj#236

Given the level of control necessary to exploit the issue (it seems likely a Step.spec could be crafted to exploit it) it seems like a low risk as the step could also just include a while True. I haven't thought through what this means for command line options or if a ReDoS in python is limited to one cpu.

[WilliamJamieson]

Since configobj is at least marginally supported as a mature library by https://github.com/DiffSK/configobj, under the PyPi name: configobj. I don't see why there is any need for stpipe to bundle its own version of configobj to begin with.

Historically, it looks as though configobj was abandoned and not fully available on PyPi at the time it was pulled into stpipe's extern. Since then it was resurrected as a mature library and maintained for bugfix purposes.

[braingram]

Unfortunately the configobj project is not maintained as mentioned in the readme:
"""
This is a mature project that is not actively maintained at this time.
"""

[WilliamJamieson]

The larger issue is that we really ought to be using a configuration format like toml which is much more widely used and supported instead of effectively rolling our own special format.