Skip to content
Projeler
Gruplar
Parçacıklar
Yardım
Yükleniyor...
Oturum aç / Kaydol
Gezinmeyi değiştir
C
cpython
Proje
Proje
Ayrıntılar
Etkinlik
Cycle Analytics
Depo (repository)
Depo (repository)
Dosyalar
Kayıtlar (commit)
Dallar (branch)
Etiketler
Katkıda bulunanlar
Grafik
Karşılaştır
Grafikler
Konular (issue)
0
Konular (issue)
0
Liste
Pano
Etiketler
Kilometre Taşları
Birleştirme (merge) Talepleri
0
Birleştirme (merge) Talepleri
0
CI / CD
CI / CD
İş akışları (pipeline)
İşler
Zamanlamalar
Grafikler
Paketler
Paketler
Wiki
Wiki
Parçacıklar
Parçacıklar
Üyeler
Üyeler
Collapse sidebar
Close sidebar
Etkinlik
Grafik
Grafikler
Yeni bir konu (issue) oluştur
İşler
Kayıtlar (commit)
Konu (issue) Panoları
Kenar çubuğunu aç
Batuhan Osman TASKAYA
cpython
Commits
74eb8b2d
Kaydet (Commit)
74eb8b2d
authored
Şub 15, 2015
tarafından
Serhiy Storchaka
Dosyalara gözat
Seçenekler
Dosyalara Gözat
İndir
Eposta Yamaları
Sade Fark
Issue #22885: Fixed arbitrary code execution vulnerability in the dbm.dumb
module. Original patch by Claudiu Popa.
üst
57fffd6f
Hide whitespace changes
Inline
Side-by-side
Showing
3 changed files
with
14 additions
and
1 deletion
+14
-1
dumb.py
Lib/dbm/dumb.py
+2
-1
test_dbm_dumb.py
Lib/test/test_dbm_dumb.py
+9
-0
NEWS
Misc/NEWS
+3
-0
No files found.
Lib/dbm/dumb.py
Dosyayı görüntüle @
74eb8b2d
...
@@ -21,6 +21,7 @@ is read when the database is opened, and some updates rewrite the whole index)
...
@@ -21,6 +21,7 @@ is read when the database is opened, and some updates rewrite the whole index)
"""
"""
import
ast
as
_ast
import
io
as
_io
import
io
as
_io
import
os
as
_os
import
os
as
_os
import
collections
import
collections
...
@@ -85,7 +86,7 @@ class _Database(collections.MutableMapping):
...
@@ -85,7 +86,7 @@ class _Database(collections.MutableMapping):
with
f
:
with
f
:
for
line
in
f
:
for
line
in
f
:
line
=
line
.
rstrip
()
line
=
line
.
rstrip
()
key
,
pos_and_siz_pair
=
eval
(
line
)
key
,
pos_and_siz_pair
=
_ast
.
literal_
eval
(
line
)
key
=
key
.
encode
(
'Latin-1'
)
key
=
key
.
encode
(
'Latin-1'
)
self
.
_index
[
key
]
=
pos_and_siz_pair
self
.
_index
[
key
]
=
pos_and_siz_pair
...
...
Lib/test/test_dbm_dumb.py
Dosyayı görüntüle @
74eb8b2d
...
@@ -217,6 +217,15 @@ class DumbDBMTestCase(unittest.TestCase):
...
@@ -217,6 +217,15 @@ class DumbDBMTestCase(unittest.TestCase):
self
.
assertEqual
(
str
(
cm
.
exception
),
self
.
assertEqual
(
str
(
cm
.
exception
),
"DBM object has already been closed"
)
"DBM object has already been closed"
)
def
test_eval
(
self
):
with
open
(
_fname
+
'.dir'
,
'w'
)
as
stream
:
stream
.
write
(
"str(print('Hacked!')), 0
\n
"
)
with
support
.
captured_stdout
()
as
stdout
:
with
self
.
assertRaises
(
ValueError
):
with
dumbdbm
.
open
(
_fname
)
as
f
:
pass
self
.
assertEqual
(
stdout
.
getvalue
(),
''
)
def
tearDown
(
self
):
def
tearDown
(
self
):
_delete_files
()
_delete_files
()
...
...
Misc/NEWS
Dosyayı görüntüle @
74eb8b2d
...
@@ -13,6 +13,9 @@ Core and Builtins
...
@@ -13,6 +13,9 @@ Core and Builtins
Library
Library
-------
-------
- Issue #22885: Fixed arbitrary code execution vulnerability in the dbm.dumb
module. Original patch by Claudiu Popa.
- Issue #23146: Fix mishandling of absolute Windows paths with forward
- Issue #23146: Fix mishandling of absolute Windows paths with forward
slashes in pathlib.
slashes in pathlib.
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment