Skip to content

C
cpython
Kaydet (Commit) a9912152 authored tarafından Victor Stinner's avatar Victor Stinner Kaydeden (comit) GitHub
Dosyalara gözat
Seçenekler

os.startfile(): add a C comment on security (#3877) 

LoadLibrary("SHELL32") is not vulnerable to DLL hijacking.
üst ccef8239
Hide whitespace changes
Inline Side-by-side
Showing with 4 additions and 0 deletions
Modules/posixmodule.c
Dosyayı görüntüle @ a9912152
...@@ -10556,6 +10556,10 @@ check_ShellExecute() ...@@ -10556,6 +10556,10 @@ check_ShellExecute()
/* only recheck */ /* only recheck */
if (-1 == has_ShellExecute) { if (-1 == has_ShellExecute) {
Py_BEGIN_ALLOW_THREADS Py_BEGIN_ALLOW_THREADS
/* Security note: this call is not vulnerable to "DLL hijacking".
SHELL32 is part of "KnownDLLs" and so Windows always load
the system SHELL32.DLL, even if there is another SHELL32.DLL
in the DLL search path. */
hShell32 = LoadLibraryW(L"SHELL32"); hShell32 = LoadLibraryW(L"SHELL32");
Py_END_ALLOW_THREADS Py_END_ALLOW_THREADS
if (hShell32) { if (hShell32) {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment