bpo-41944: No longer call eval() on content received via HTTP in the CJK codec tests #22566

serhiy-storchaka · 2020-10-05T14:49:58Z

https://bugs.python.org/issue41944

…CJK codec tests

vstinner · 2020-10-06T06:49:55Z

Lib/test/multibytecodec_support.py

-                elif csetval >= 0x100:
-                    csetch = bytes([(csetval >> 8), (csetval & 0xff)])
-                else:
+                assert data[0][:2] == '0x'


I suggest something like:

if not data[0].startswith('0x'): self.fail(f"Invalid line: {line!r}")

vstinner

LGTM.

Tests still pass with this change:

grep -l multibytecodec_support Lib/test/*py > tests
./python -m test -u all --fromfile=tests -j0 -v

miss-islington · 2020-10-06T12:14:55Z

Thanks @serhiy-storchaka for the PR 🌮🎉.. I'm working now to backport this PR to: 3.8, 3.9.
🐍🍒⛏🤖

…CJK codec tests (pythonGH-22566) (cherry picked from commit 2ef5caa) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

bedevere-bot · 2020-10-06T12:15:12Z

GH-22576 is a backport of this pull request to the 3.9 branch.

…CJK codec tests (pythonGH-22566) (cherry picked from commit 2ef5caa) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

bedevere-bot · 2020-10-06T12:15:22Z

GH-22577 is a backport of this pull request to the 3.8 branch.

…CJK codec tests (GH-22566) (cherry picked from commit 2ef5caa) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

miss-islington · 2020-10-06T12:37:50Z

Thanks @serhiy-storchaka for the PR 🌮🎉.. I'm working now to backport this PR to: 3.6.
🐍🍒⛏🤖

miss-islington · 2020-10-06T12:37:50Z

Thanks @serhiy-storchaka for the PR 🌮🎉.. I'm working now to backport this PR to: 3.7.
🐍🍒⛏🤖

bedevere-bot · 2020-10-06T12:38:09Z

GH-22578 is a backport of this pull request to the 3.7 branch.

bedevere-bot · 2020-10-06T12:38:20Z

GH-22579 is a backport of this pull request to the 3.6 branch.

…CJK codec tests (pythonGH-22566) (cherry picked from commit 2ef5caa) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

…CJK codec tests (GH-22566) (GH-22577) (cherry picked from commit 2ef5caa) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

…UnicodeNames tests (GH-22575) Similarly to GH-22566, those tests called eval() on content received via HTTP in test_named_sequences_full. This likely isn't exploitable because unicodedata.lookup(seqname) is called before self.checkletter(seqname, None) - thus any string which isn't a valid unicode character name wouldn't ever reach the checkletter method. Still, it's probably better to be safe than sorry.

* origin/master: (147 commits) Fix the attribute names in the docstring of GenericAlias (pythonGH-22594) bpo-39337: Add a test case for normalizing of codec names (pythonGH-19069) bpo-41557: Update Windows installer to use SQLite 3.33.0 (pythonGH-21960) bpo-41976: Fix the fallback to gcc of ctypes.util.find_library when using gcc>9 (pythonGH-22598) bpo-41306: Allow scale value to not be rounded (pythonGH-21715) bpo-41970: Avoid test failure in test_lib2to3 if the module is already imported (pythonGH-22595) bpo-41376: Fix the documentation of `site.getusersitepackages()` (pythonGH-21602) Revert "bpo-26680: Incorporate is_integer in all built-in and standard library numeric types (pythonGH-6121)" (pythonGH-22584) bpo-41923: PEP 613: Add TypeAlias to typing module (python#22532) Fix comment about PyObject_IsTrue. (pythonGH-22343) bpo-38605: Make 'from __future__ import annotations' the default (pythonGH-20434) bpo-41905: Add abc.update_abstractmethods() (pythonGH-22485) bpo-41944: No longer call eval() on content received via HTTP in the UnicodeNames tests (pythonGH-22575) bpo-41944: No longer call eval() on content received via HTTP in the CJK codec tests (pythonGH-22566) Post 3.10.0a1 Python 3.10.0a1 bpo-41584: clarify when the reflected method of a binary arithemtic operator is called (python#22505) bpo-41939: Fix test_site.test_license_exists_at_url() (python#22559) bpo-41774: Tweak new programming FAQ entry (pythonGH-22562) bpo-41936. Remove macros Py_ALLOW_RECURSION/Py_END_ALLOW_RECURSION (pythonGH-22552) ...

…CJK codec tests (pythonGH-22566)

…UnicodeNames tests (pythonGH-22575) Similarly to pythonGH-22566, those tests called eval() on content received via HTTP in test_named_sequences_full. This likely isn't exploitable because unicodedata.lookup(seqname) is called before self.checkletter(seqname, None) - thus any string which isn't a valid unicode character name wouldn't ever reach the checkletter method. Still, it's probably better to be safe than sorry.

…CJK codec tests (GH-22566) (GH-22578) (cherry picked from commit 2ef5caa) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

…CJK codec tests (GH-22566) (GH-22579) (cherry picked from commit 2ef5caa) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

…CJK codec tests (pythonGH-22566) (pythonGH-22579) (cherry picked from commit 2ef5caa) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Rebased for Python 2.7 by Michał Górny <mgorny@gentoo.org>

bpo-41944: No longer call eval() on content received via HTTP in the …

e0e3761

…CJK codec tests

serhiy-storchaka added tests Tests in the Lib/test dir type-security A security issue needs backport to 3.8 needs backport to 3.9 only security fixes labels Oct 5, 2020

the-knights-who-say-ni added the CLA signed label Oct 5, 2020

bedevere-bot added the awaiting core review label Oct 5, 2020

vstinner reviewed Oct 6, 2020

View reviewed changes

Convert assert to fail().

2fdfdc1

vstinner approved these changes Oct 6, 2020

View reviewed changes

bedevere-bot added awaiting merge and removed awaiting core review labels Oct 6, 2020

The-Compiler mentioned this pull request Oct 6, 2020

bpo-41944: No longer call eval() on content received via HTTP in the UnicodeNames tests #22575

Merged

serhiy-storchaka merged commit 2ef5caa into python:master Oct 6, 2020

bedevere-bot removed the awaiting merge label Oct 6, 2020

serhiy-storchaka deleted the test-multibytecodec_support-eval branch October 6, 2020 12:14

bedevere-bot removed the needs backport to 3.9 only security fixes label Oct 6, 2020

bedevere-bot removed the needs backport to 3.8 label Oct 6, 2020

miss-islington added a commit that referenced this pull request Oct 6, 2020

bpo-41944: No longer call eval() on content received via HTTP in the …

b664a1d

…CJK codec tests (GH-22566) (cherry picked from commit 2ef5caa) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

vstinner added needs backport to 3.6 labels Oct 6, 2020

bedevere-bot removed the needs backport to 3.7 label Oct 6, 2020

bedevere-bot removed the needs backport to 3.6 label Oct 6, 2020

xzy3 pushed a commit to xzy3/cpython that referenced this pull request Oct 18, 2020

bpo-41944: No longer call eval() on content received via HTTP in the …

ede0d6c

…CJK codec tests (pythonGH-22566)

ned-deily pushed a commit that referenced this pull request Oct 20, 2020

bpo-41944: No longer call eval() on content received via HTTP in the …

43e5231

…CJK codec tests (GH-22566) (GH-22578) (cherry picked from commit 2ef5caa) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

ned-deily pushed a commit that referenced this pull request Oct 20, 2020

bpo-41944: No longer call eval() on content received via HTTP in the …

e912e94

…CJK codec tests (GH-22566) (GH-22579) (cherry picked from commit 2ef5caa) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

ucodery mentioned this pull request Nov 10, 2020

Address CVE-2020-27619 for multibytecodec tests ActiveState/cpython#4

Merged

serhiy-storchaka mentioned this pull request Apr 10, 2022

[security][CVE-2020-27619] Python testsuite calls eval() on content received via HTTP #86110

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

bpo-41944: No longer call eval() on content received via HTTP in the CJK codec tests #22566

bpo-41944: No longer call eval() on content received via HTTP in the CJK codec tests #22566

Uh oh!

serhiy-storchaka commented Oct 5, 2020 •

edited by bedevere-bot

Loading

Uh oh!

vstinner Oct 6, 2020

Uh oh!

vstinner left a comment

Uh oh!

miss-islington commented Oct 6, 2020

Uh oh!

bedevere-bot commented Oct 6, 2020

Uh oh!

bedevere-bot commented Oct 6, 2020

Uh oh!

miss-islington commented Oct 6, 2020

Uh oh!

miss-islington commented Oct 6, 2020

Uh oh!

bedevere-bot commented Oct 6, 2020

Uh oh!

bedevere-bot commented Oct 6, 2020

Uh oh!

Uh oh!

Uh oh!

bpo-41944: No longer call eval() on content received via HTTP in the CJK codec tests #22566

bpo-41944: No longer call eval() on content received via HTTP in the CJK codec tests #22566

Uh oh!

Conversation

serhiy-storchaka commented Oct 5, 2020 • edited by bedevere-bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vstinner Oct 6, 2020

Choose a reason for hiding this comment

Uh oh!

vstinner left a comment

Choose a reason for hiding this comment

Uh oh!

miss-islington commented Oct 6, 2020

Uh oh!

bedevere-bot commented Oct 6, 2020

Uh oh!

bedevere-bot commented Oct 6, 2020

Uh oh!

miss-islington commented Oct 6, 2020

Uh oh!

miss-islington commented Oct 6, 2020

Uh oh!

bedevere-bot commented Oct 6, 2020

Uh oh!

bedevere-bot commented Oct 6, 2020

Uh oh!

Uh oh!

serhiy-storchaka commented Oct 5, 2020 •

edited by bedevere-bot

Loading