Mirror
/
cpython
mirror of https://github.com/python/cpython
4
1
Fork 0
Code Issues Releases Wiki Activity

bpo-46251: Add 'Security Considerations' section to logging configura… (GH-30411)

This commit is contained in:
Vinay Sajip 2022-01-06 22:35:08 +00:00 committed by GitHub
parent c9137d4b63
commit 46c7a6566b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
Doc/library/logging.config.rst
View File

@ -191,6 +191,20 @@ in :mod:`logging` itself) and defining handlers which are declared either in
:func:`listen`.
Security considerations
^^^^^^^^^^^^^^^^^^^^^^^
The logging configuration functionality tries to offer convenience, and in part this
is done by offering the ability to convert text in configuration files into Python
objects used in logging configuration - for example, as described in
:ref:`logging-config-dict-userdef`. However, these same mechanisms (importing
callables from user-defined modules and calling them with parameters from the
configuration) could be used to invoke any code you like, and for this reason you
should treat configuration files from untrusted sources with *extreme caution* and
satisfy yourself that nothing bad can happen if you load them, before actually loading
them.
.. _logging-config-dictschema:
Configuration dictionary schema