gh-68966: Make mailcap refuse to match unsafe filenames/types/params #91993

encukou · 2022-04-27T16:29:09Z

Here is a possible fix for CVE-2015-20107 for cases where mailcap needs to continue working, at least when following best practices: refuse to inject text into commands unless deemed safe by a list of allowed characters.

add docs

…arams

vstinner · 2022-04-28T07:31:24Z

Lib/mailcap.py

+    if _find_unsafe(filename):
+        msg = "Refusing to use mailcap with filename %r. Use a safe temporary filename." % (filename,)
+        warnings.warn(msg, UnsafeMailcapInput)
+        return None, None


Usually when a warning is displayed, the function still returns its regular result. For example, calling a deprecated function emits a DeprecationWarning, but the function is executed. If we go this way (reject filenames which look unsafe), I suggest to raise an exception instead.

In this case, IMO since the caller should always do whatever it does on None result -- fall back to some other mechanism, or ask the user -- returning None is less disruptive.

gpshead · 2022-05-11T00:01:27Z

Lib/mailcap.py

@@ -19,6 +20,11 @@ def lineno_sort_key(entry):
    else:
        return 1, 0

+_find_unsafe = re.compile(r'[^\xa1-\U0010FFFF\w@%+=:,./-]').search


is % safe? DOS derived shells use that for variable expansion IIRC.

Mailcap implements the “Implementation Details for UNIX” appendix of RFC-1524 (which is what specifies using % for the placeholders), and that says:

(Because of differences in shells and the implementation and behavior of the same shell from one system to another, it is specified that the command line be intended as input to the Bourne shell, i.e., that it is implicitly preceded by "/bin/sh -c " on the command line.)

So I'd say it's safe for Python to allow %. But it also won't hurt much to disallow it, so I'll do that.

…cond argument Source: python/cpython#91993 MR: 117402 Type: Security Fix Disposition: Backport from python/cpython@c3e7f13 ChangeID: 7118c5678a340cfcad95b0e5fb116b8919e389b8 Description: CVE-2015-20107 python(mailcap): findmatch() function does not sanitise the second argument. Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com>

frenzymadness · 2022-06-02T09:40:11Z

I think it's good and it seems to work well. I like the regex.

miss-islington · 2022-06-03T09:43:38Z

Thanks @encukou for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖

…arams (pythonGH-91993) (cherry picked from commit b9509ba) Co-authored-by: Petr Viktorin <encukou@gmail.com>

bedevere-bot · 2022-06-03T09:43:49Z

GH-93458 is a backport of this pull request to the 3.11 branch.

…params (GH-91993) (GH-93458) (cherry picked from commit b9509ba) Co-authored-by: Petr Viktorin <encukou@gmail.com> Automerge-Triggered-By: GH:encukou

…cond argument Source: python/cpython#91993 MR: 117410 Type: Security Fix Disposition: Backport from python/cpython@c3e7f13 ChangeID: 6101cf28d6a5288fe07c654df016c3f5810c705a Description: CVE-2015-20107 python(mailcap): findmatch() function does not sanitise the second argument. Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com>

miss-islington · 2022-06-06T15:32:21Z

Thanks @encukou for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10.
🐍🍒⛏🤖

bedevere-bot · 2022-06-06T15:32:28Z

GH-93543 is a backport of this pull request to the 3.10 branch.

bedevere-bot · 2022-10-11T19:54:52Z

GH-98192 is a backport of this pull request to the 3.8 branch.

…arams (pythonGH-91993) (cherry picked from commit b9509ba) Co-authored-by: Petr Viktorin <encukou@gmail.com>

miss-islington · 2022-10-11T20:09:32Z

Thanks @encukou for the PR 🌮🎉.. I'm working now to backport this PR to: 3.7.
🐍🍒⛏🤖

…arams (pythonGH-91993) (cherry picked from commit b9509ba) Co-authored-by: Petr Viktorin <encukou@gmail.com>

ambv · 2022-10-11T20:11:29Z

#98191 is the 3.7 backport. Bedevere somehow missed the comment here.

…arams (GH-91993) (GH-98191) gh-68966: Make mailcap refuse to match unsafe filenames/types/params (GH-91993) (cherry picked from commit b9509ba) Co-authored-by: Petr Viktorin <encukou@gmail.com>

…arams (GH-91993) (#98190) gh-68966: Make mailcap refuse to match unsafe filenames/types/params (GH-91993) (cherry picked from commit b9509ba) Co-authored-by: Petr Viktorin <encukou@gmail.com>

…arams (GH-91993) (#98192) gh-68966: Make mailcap refuse to match unsafe filenames/types/params (GH-91993) (cherry picked from commit b9509ba) Co-authored-by: Petr Viktorin <encukou@gmail.com> Co-authored-by: Łukasz Langa <lukasz@langa.pl>

Make mailcap refuse to match unsafe filenames/types/params (pythonGH-91993) Upstream: python#68966 Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390

* Fix CVE-2015-20107 Implemented fix from python/cpython#91993 * Update regex Update regex to be Python 2 compatible.

00382 # Make mailcap refuse to match unsafe filenames/types/params (pythonGH-91993) Upstream: python#68966 Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390 Backported from python3.

Make mailcap refuse to match unsafe filenames/types/params (pythonGH-91993) Upstream: python#68966 Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390

pythongh-68966: Make mailcap refuse to match unsafe filenames/types/p…

c3e7f13

…arams

bedevere-bot added the awaiting core review label Apr 27, 2022

Add blurb

3904f68

encukou mentioned this pull request Apr 27, 2022

[CVE-2015-20107] mailcap.findmatch: document shell command Injection danger in filename parameter #68966

Closed

vstinner reviewed Apr 28, 2022

View reviewed changes

arhadthedev mentioned this pull request Apr 28, 2022

gh-68966: Fix CVE-2015-20107 in mailcap #91542

Closed

gpshead reviewed May 11, 2022

View reviewed changes

encukou added 2 commits May 26, 2022 16:16

Disallow % as well

b94ce0a

Add docs note

176eb5f

encukou marked this pull request as ready for review May 26, 2022 15:14

encukou requested a review from a team as a code owner May 26, 2022 15:14

encukou added the needs backport to 3.11 only security fixes label May 26, 2022

encukou merged commit b9509ba into python:main Jun 3, 2022

bedevere-bot removed the awaiting core review label Jun 3, 2022

encukou deleted the mailcap-refusal branch June 3, 2022 09:43

bedevere-bot removed the needs backport to 3.11 only security fixes label Jun 3, 2022

encukou mentioned this pull request Jun 3, 2022

gh-68966: fix CVE-2015-20107 #93014

Closed

encukou added 3.10 only security fixes needs backport to 3.10 only security fixes and removed 3.10 only security fixes labels Jun 6, 2022

bedevere-bot removed the needs backport to 3.10 only security fixes label Jun 6, 2022

bedevere-bot removed the needs backport to 3.9 only security fixes label Oct 11, 2022

bedevere-bot removed the needs backport to 3.8 label Oct 11, 2022

ambv added needs backport to 3.7 and removed needs backport to 3.7 labels Oct 11, 2022

ambv removed the needs backport to 3.7 label Oct 11, 2022

hroncok pushed a commit to fedora-python/cpython that referenced this pull request Oct 12, 2022

00382: CVE-2015-20107

3923622

Make mailcap refuse to match unsafe filenames/types/params (pythonGH-91993) Upstream: python#68966 Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390

hroncok pushed a commit to fedora-python/cpython that referenced this pull request Oct 12, 2022

00382: CVE-2015-20107

e40751c

Make mailcap refuse to match unsafe filenames/types/params (pythonGH-91993) Upstream: python#68966 Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390

hroncok pushed a commit to fedora-python/cpython that referenced this pull request Oct 12, 2022

00382: CVE-2015-20107

642eb6e

Make mailcap refuse to match unsafe filenames/types/params (pythonGH-91993) Upstream: python#68966 Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390

danpetry mentioned this pull request Oct 17, 2022

Update 3.7.13 AnacondaRecipes/python-feedstock#73

Merged

AkanshDivker mentioned this pull request Jan 12, 2023

Fix CVE-2015-20107 IronLanguages/ironpython2#827

Merged

slozier pushed a commit to IronLanguages/ironpython2 that referenced this pull request Jan 13, 2023

Fix CVE-2015-20107 (#827)

d001118

* Fix CVE-2015-20107 Implemented fix from python/cpython#91993 * Update regex Update regex to be Python 2 compatible.

stratakis pushed a commit to stratakis/cpython that referenced this pull request Mar 11, 2024

00382: CVE-2015-20107

573f018

Make mailcap refuse to match unsafe filenames/types/params (pythonGH-91993) Upstream: python#68966 Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390

stratakis pushed a commit to stratakis/cpython that referenced this pull request Mar 11, 2024

00382: CVE-2015-20107

a9d260b

Make mailcap refuse to match unsafe filenames/types/params (pythonGH-91993) Upstream: python#68966 Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390

stratakis pushed a commit to stratakis/cpython that referenced this pull request Mar 20, 2024

00382: CVE-2015-20107

4ecf0fb

Make mailcap refuse to match unsafe filenames/types/params (pythonGH-91993) Upstream: python#68966 Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390

stratakis pushed a commit to stratakis/cpython that referenced this pull request Mar 20, 2024

00382: CVE-2015-20107

a557b3c

Make mailcap refuse to match unsafe filenames/types/params (pythonGH-91993) Upstream: python#68966 Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390

stratakis pushed a commit to stratakis/cpython that referenced this pull request Mar 20, 2024

00382: CVE-2015-20107

5fd22d0

Make mailcap refuse to match unsafe filenames/types/params (pythonGH-91993) Upstream: python#68966 Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390

stratakis pushed a commit to stratakis/cpython that referenced this pull request Mar 20, 2024

00382: CVE-2015-20107

273dac3

Make mailcap refuse to match unsafe filenames/types/params (pythonGH-91993) Upstream: python#68966 Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390

stratakis pushed a commit to stratakis/cpython that referenced this pull request Mar 25, 2024

00382: CVE-2015-20107

c37c6c3

Make mailcap refuse to match unsafe filenames/types/params (pythonGH-91993) Upstream: python#68966 Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390

hroncok pushed a commit to fedora-python/cpython that referenced this pull request Mar 26, 2024

00382: CVE-2015-20107

fbb090b

Make mailcap refuse to match unsafe filenames/types/params (pythonGH-91993) Upstream: python#68966 Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390

mcepl pushed a commit to openSUSE-Python/cpython that referenced this pull request Apr 2, 2024

00382: CVE-2015-20107

6fe8c2d

Make mailcap refuse to match unsafe filenames/types/params (pythonGH-91993) Upstream: python#68966 Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

gh-68966: Make mailcap refuse to match unsafe filenames/types/params #91993

gh-68966: Make mailcap refuse to match unsafe filenames/types/params #91993

encukou commented Apr 27, 2022 •

edited

Loading

vstinner Apr 28, 2022

encukou Apr 28, 2022 •

edited

Loading

gpshead May 11, 2022

encukou May 26, 2022

frenzymadness commented Jun 2, 2022

miss-islington commented Jun 3, 2022

bedevere-bot commented Jun 3, 2022

miss-islington commented Jun 6, 2022

bedevere-bot commented Jun 6, 2022

bedevere-bot commented Oct 11, 2022

miss-islington commented Oct 11, 2022

ambv commented Oct 11, 2022

gh-68966: Make mailcap refuse to match unsafe filenames/types/params #91993

gh-68966: Make mailcap refuse to match unsafe filenames/types/params #91993

Conversation

encukou commented Apr 27, 2022 • edited Loading

vstinner Apr 28, 2022

Choose a reason for hiding this comment

encukou Apr 28, 2022 • edited Loading

Choose a reason for hiding this comment

gpshead May 11, 2022

Choose a reason for hiding this comment

encukou May 26, 2022

Choose a reason for hiding this comment

frenzymadness commented Jun 2, 2022

miss-islington commented Jun 3, 2022

bedevere-bot commented Jun 3, 2022

miss-islington commented Jun 6, 2022

bedevere-bot commented Jun 6, 2022

bedevere-bot commented Oct 11, 2022

miss-islington commented Oct 11, 2022

ambv commented Oct 11, 2022

encukou commented Apr 27, 2022 •

edited

Loading

encukou Apr 28, 2022 •

edited

Loading