mirror of https://github.com/python/cpython
bpo-42988: Remove the pydoc getfile feature (GH-25015)
CVE-2021-3426: Remove the "getfile" feature of the pydoc module which could be abused to read arbitrary files on the disk (directory traversal vulnerability). Moreover, even source code of Python modules can contain sensitive data like passwords. Vulnerability reported by David Schwörer.
This commit is contained in:
parent
4827483f47
commit
9b999479c0
18
Lib/pydoc.py
18
Lib/pydoc.py
|
@ -2456,9 +2456,6 @@ def _url_handler(url, content_type="text/html"):
|
|||
%s</head><body bgcolor="#f0f0f8">%s<div style="clear:both;padding-top:.5em;">%s</div>
|
||||
</body></html>''' % (title, css_link, html_navbar(), contents)
|
||||
|
||||
def filelink(self, url, path):
|
||||
return '<a href="getfile?key=%s">%s</a>' % (url, path)
|
||||
|
||||
|
||||
html = _HTMLDoc()
|
||||
|
||||
|
@ -2544,19 +2541,6 @@ def _url_handler(url, content_type="text/html"):
|
|||
'key = %s' % key, '#ffffff', '#ee77aa', '<br>'.join(results))
|
||||
return 'Search Results', contents
|
||||
|
||||
def html_getfile(path):
|
||||
"""Get and display a source file listing safely."""
|
||||
path = urllib.parse.unquote(path)
|
||||
with tokenize.open(path) as fp:
|
||||
lines = html.escape(fp.read())
|
||||
body = '<pre>%s</pre>' % lines
|
||||
heading = html.heading(
|
||||
'<big><big><strong>File Listing</strong></big></big>',
|
||||
'#ffffff', '#7799ee')
|
||||
contents = heading + html.bigsection(
|
||||
'File: %s' % path, '#ffffff', '#ee77aa', body)
|
||||
return 'getfile %s' % path, contents
|
||||
|
||||
def html_topics():
|
||||
"""Index of topic texts available."""
|
||||
|
||||
|
@ -2648,8 +2632,6 @@ def _url_handler(url, content_type="text/html"):
|
|||
op, _, url = url.partition('=')
|
||||
if op == "search?key":
|
||||
title, content = html_search(url)
|
||||
elif op == "getfile?key":
|
||||
title, content = html_getfile(url)
|
||||
elif op == "topic?key":
|
||||
# try topics first, then objects.
|
||||
try:
|
||||
|
|
|
@ -1374,18 +1374,12 @@ class PydocUrlHandlerTest(PydocBaseTest):
|
|||
("topic?key=def", "Pydoc: KEYWORD def"),
|
||||
("topic?key=STRINGS", "Pydoc: TOPIC STRINGS"),
|
||||
("foobar", "Pydoc: Error - foobar"),
|
||||
("getfile?key=foobar", "Pydoc: Error - getfile?key=foobar"),
|
||||
]
|
||||
|
||||
with self.restrict_walk_packages():
|
||||
for url, title in requests:
|
||||
self.call_url_handler(url, title)
|
||||
|
||||
path = string.__file__
|
||||
title = "Pydoc: getfile " + path
|
||||
url = "getfile?key=" + path
|
||||
self.call_url_handler(url, title)
|
||||
|
||||
|
||||
class TestHelper(unittest.TestCase):
|
||||
def test_keywords(self):
|
||||
|
|
|
@ -0,0 +1,4 @@
|
|||
CVE-2021-3426: Remove the ``getfile`` feature of the :mod:`pydoc` module which
|
||||
could be abused to read arbitrary files on the disk (directory traversal
|
||||
vulnerability). Moreover, even source code of Python modules can contain
|
||||
sensitive data like passwords. Vulnerability reported by David Schwörer.
|
Loading…
Reference in New Issue