gh-68966: Make mailcap refuse to match unsafe filenames/types/params #91993

encukou · 2022-04-27T16:29:09Z

Here is a possible fix for CVE-2015-20107 for cases where mailcap needs to continue working, at least when following best practices: refuse to inject text into commands unless deemed safe by a list of allowed characters.

add docs

…arams

vstinner · 2022-04-28T07:32:32Z

Lib/mailcap.py

+    if _find_unsafe(filename):
+        msg = "Refusing to use mailcap with filename %r. Use a safe temporary filename." % (filename,)
+        warnings.warn(msg, UnsafeMailcapInput)
+        return None, None


Usually when a warning is displayed, the function still returns its regular result. For example, calling a deprecated function emits a DeprecationWarning, but the function is executed. If we go this way (reject filenames which look unsafe), I suggest to raise an exception instead.

In this case, IMO since the caller should always do whatever it does on None result -- fall back to some other mechanism, or ask the user -- returning None is less disruptive.

gpshead · 2022-05-11T00:01:27Z

Lib/mailcap.py

@@ -19,6 +20,11 @@ def lineno_sort_key(entry):
    else:
        return 1, 0

+_find_unsafe = re.compile(r'[^\xa1-\U0010FFFF\w@%+=:,./-]').search


is % safe? DOS derived shells use that for variable expansion IIRC.

Mailcap implements the “Implementation Details for UNIX” appendix of RFC-1524 (which is what specifies using % for the placeholders), and that says:

(Because of differences in shells and the implementation and behavior of the same shell from one system to another, it is specified that the command line be intended as input to the Bourne shell, i.e., that it is implicitly preceded by "/bin/sh -c " on the command line.)

So I'd say it's safe for Python to allow %. But it also won't hurt much to disallow it, so I'll do that.

…cond argument Source: python/cpython#91993 MR: 117402 Type: Security Fix Disposition: Backport from python/cpython@c3e7f13 ChangeID: 7118c5678a340cfcad95b0e5fb116b8919e389b8 Description: CVE-2015-20107 python(mailcap): findmatch() function does not sanitise the second argument. Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com>

frenzymadness · 2022-06-02T09:40:11Z

I think it's good and it seems to work well. I like the regex.

miss-islington · 2022-06-03T09:43:38Z

Thanks @encukou for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖

…arams (pythonGH-91993) (cherry picked from commit b9509ba) Co-authored-by: Petr Viktorin <encukou@gmail.com>

bedevere-bot · 2022-06-03T09:43:49Z

GH-93458 is a backport of this pull request to the 3.11 branch.

…params (GH-91993) (GH-93458) (cherry picked from commit b9509ba) Co-authored-by: Petr Viktorin <encukou@gmail.com> Automerge-Triggered-By: GH:encukou

…cond argument Source: python/cpython#91993 MR: 117410 Type: Security Fix Disposition: Backport from python/cpython@c3e7f13 ChangeID: 6101cf28d6a5288fe07c654df016c3f5810c705a Description: CVE-2015-20107 python(mailcap): findmatch() function does not sanitise the second argument. Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com>

miss-islington · 2022-06-06T15:32:21Z

Thanks @encukou for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10.
🐍🍒⛏🤖

bedevere-bot · 2022-06-06T15:32:28Z

GH-93543 is a backport of this pull request to the 3.10 branch.

Make mailcap refuse to match unsafe filenames/types/params (pythonGH-91993) Upstream: python#68966 Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390

…params (GH-91993) (GH-93543) * gh-68966: Make mailcap refuse to match unsafe filenames/types/params (GH-91993) (cherry picked from commit b9509ba) * Add a What's New entry for 3.10.8. Co-authored-by: Petr Viktorin <encukou@gmail.com> Co-authored-by: Gregory P. Smith <greg@krypto.org>

miss-islington · 2022-10-11T19:54:34Z

Thanks @encukou for the PR 🌮🎉.. I'm working now to backport this PR to: 3.9.
🐍🍒⛏🤖

miss-islington · 2022-10-11T19:54:34Z

Thanks @encukou for the PR 🌮🎉.. I'm working now to backport this PR to: 3.7.
🐍🍒⛏🤖

miss-islington · 2022-10-11T19:54:34Z

Thanks @encukou for the PR 🌮🎉.. I'm working now to backport this PR to: 3.8.
🐍🍒⛏🤖

bedevere-bot · 2022-10-11T19:54:45Z

GH-98190 is a backport of this pull request to the 3.9 branch.

bedevere-bot · 2022-10-11T19:54:52Z

GH-98192 is a backport of this pull request to the 3.8 branch.

…arams (pythonGH-91993) (cherry picked from commit b9509ba) Co-authored-by: Petr Viktorin <encukou@gmail.com>

miss-islington · 2022-10-11T20:09:32Z

Thanks @encukou for the PR 🌮🎉.. I'm working now to backport this PR to: 3.7.
🐍🍒⛏🤖

…arams (pythonGH-91993) (cherry picked from commit b9509ba) Co-authored-by: Petr Viktorin <encukou@gmail.com>

ambv · 2022-10-11T20:11:29Z

#98191 is the 3.7 backport. Bedevere somehow missed the comment here.

…arams (GH-91993) (GH-98191) gh-68966: Make mailcap refuse to match unsafe filenames/types/params (GH-91993) (cherry picked from commit b9509ba) Co-authored-by: Petr Viktorin <encukou@gmail.com>

…arams (GH-91993) (#98190) gh-68966: Make mailcap refuse to match unsafe filenames/types/params (GH-91993) (cherry picked from commit b9509ba) Co-authored-by: Petr Viktorin <encukou@gmail.com>

…arams (GH-91993) (#98192) gh-68966: Make mailcap refuse to match unsafe filenames/types/params (GH-91993) (cherry picked from commit b9509ba) Co-authored-by: Petr Viktorin <encukou@gmail.com> Co-authored-by: Łukasz Langa <lukasz@langa.pl>

Make mailcap refuse to match unsafe filenames/types/params (pythonGH-91993) Upstream: python#68966 Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390

pythongh-68966: Make mailcap refuse to match unsafe filenames/types/p…

c3e7f13

…arams

bedevere-bot added the awaiting core review label Apr 27, 2022

Add blurb

3904f68

encukou mentioned this pull request Apr 27, 2022

[CVE-2015-20107] mailcap.findmatch: document shell command Injection danger in filename parameter #68966

Closed

vstinner reviewed Apr 28, 2022

View changes

arhadthedev mentioned this pull request Apr 28, 2022

gh-68966: Fix CVE-2015-20107 in mailcap #91542

Closed

gpshead reviewed May 11, 2022

View changes

encukou added 2 commits May 26, 2022

Disallow % as well

b94ce0a

Add docs note

176eb5f

encukou marked this pull request as ready for review May 26, 2022

encukou requested a review from a team as a code owner May 26, 2022

encukou added the needs backport to 3.11 label May 26, 2022

encukou merged commit b9509ba into python:main Jun 3, 2022
13 checks passed

bedevere-bot removed the awaiting core review label Jun 3, 2022

encukou deleted the mailcap-refusal branch Jun 3, 2022

bedevere-bot removed the needs backport to 3.11 label Jun 3, 2022

encukou mentioned this pull request Jun 3, 2022

gh-68966: fix CVE-2015-20107 #93014

Closed

encukou added 3.10 needs backport to 3.10 and removed 3.10 labels Jun 6, 2022

bedevere-bot removed the needs backport to 3.10 label Jun 6, 2022

hroncok pushed a commit to hroncok/cpython that referenced this pull request Aug 22, 2022

00382: CVE-2015-20107

8c812ba

Make mailcap refuse to match unsafe filenames/types/params (pythonGH-91993) Upstream: python#68966 Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390

hroncok pushed a commit to fedora-python/cpython that referenced this pull request Sep 7, 2022

00382: CVE-2015-20107

f592ff4

Make mailcap refuse to match unsafe filenames/types/params (pythonGH-91993) Upstream: python#68966 Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390

hroncok pushed a commit to fedora-python/cpython that referenced this pull request Sep 7, 2022

00382: CVE-2015-20107

a9dfaef

Make mailcap refuse to match unsafe filenames/types/params (pythonGH-91993) Upstream: python#68966 Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390

hroncok pushed a commit to fedora-python/cpython that referenced this pull request Sep 7, 2022

00382: CVE-2015-20107

ea551b1

Make mailcap refuse to match unsafe filenames/types/params (pythonGH-91993) Upstream: python#68966 Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390

hroncok pushed a commit to fedora-python/cpython that referenced this pull request Sep 7, 2022

00382: CVE-2015-20107

4728137

Make mailcap refuse to match unsafe filenames/types/params (pythonGH-91993) Upstream: python#68966 Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390

ambv added needs backport to 3.7 needs backport to 3.8 needs backport to 3.9 labels Oct 11, 2022

bedevere-bot removed the needs backport to 3.9 label Oct 11, 2022

bedevere-bot removed the needs backport to 3.8 label Oct 11, 2022

ambv added needs backport to 3.7 and removed needs backport to 3.7 labels Oct 11, 2022

ambv removed the needs backport to 3.7 label Oct 11, 2022

hroncok pushed a commit to fedora-python/cpython that referenced this pull request Oct 12, 2022

00382: CVE-2015-20107

3923622

Make mailcap refuse to match unsafe filenames/types/params (pythonGH-91993) Upstream: python#68966 Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390

hroncok pushed a commit to fedora-python/cpython that referenced this pull request Oct 12, 2022

00382: CVE-2015-20107

e40751c

Make mailcap refuse to match unsafe filenames/types/params (pythonGH-91993) Upstream: python#68966 Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390

hroncok pushed a commit to fedora-python/cpython that referenced this pull request Oct 12, 2022

00382: CVE-2015-20107

642eb6e

Make mailcap refuse to match unsafe filenames/types/params (pythonGH-91993) Upstream: python#68966 Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390

gh-68966: Make mailcap refuse to match unsafe filenames/types/params #91993

gh-68966: Make mailcap refuse to match unsafe filenames/types/params #91993

encukou commented Apr 27, 2022 •

edited

vstinner Apr 28, 2022

encukou Apr 28, 2022 •

edited

gpshead May 11, 2022

encukou May 26, 2022

frenzymadness commented Jun 2, 2022

miss-islington commented Jun 3, 2022

bedevere-bot commented Jun 3, 2022

miss-islington commented Jun 6, 2022

bedevere-bot commented Jun 6, 2022

miss-islington commented Oct 11, 2022

miss-islington commented Oct 11, 2022

miss-islington commented Oct 11, 2022

bedevere-bot commented Oct 11, 2022

bedevere-bot commented Oct 11, 2022

miss-islington commented Oct 11, 2022

ambv commented Oct 11, 2022

gh-68966: Make mailcap refuse to match unsafe filenames/types/params #91993

gh-68966: Make mailcap refuse to match unsafe filenames/types/params #91993

Conversation

encukou commented Apr 27, 2022 • edited

vstinner Apr 28, 2022

Choose a reason for hiding this comment

encukou Apr 28, 2022 • edited

Choose a reason for hiding this comment

gpshead May 11, 2022

Choose a reason for hiding this comment

encukou May 26, 2022

Choose a reason for hiding this comment

frenzymadness commented Jun 2, 2022

miss-islington commented Jun 3, 2022

bedevere-bot commented Jun 3, 2022

miss-islington commented Jun 6, 2022

bedevere-bot commented Jun 6, 2022

miss-islington commented Oct 11, 2022

miss-islington commented Oct 11, 2022

miss-islington commented Oct 11, 2022

bedevere-bot commented Oct 11, 2022

bedevere-bot commented Oct 11, 2022

miss-islington commented Oct 11, 2022

ambv commented Oct 11, 2022

encukou commented Apr 27, 2022 •

edited

encukou Apr 28, 2022 •

edited