FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

gh-123270: Replaced SanitizedNames with a more surgical fix. by jaraco · Pull Request #123354 · python/cpython · GitHub

/ cpython Public

gh-123270: Replaced SanitizedNames with a more surgical fix. - #123354

Merged
jaraco merged 1 commit into
python:mainfrom
jaraco:gh-123270/secure-allowed-names
Aug 27, 2024
ConversationCommits (1)ChecksFiles changed
Merged

gh-123270: Replaced SanitizedNames with a more surgical fix.#123354
jaraco merged 1 commit into
python:mainfrom
jaraco:gh-123270/secure-allowed-names

Conversation

jaraco commented Aug 26, 2024 •
edited
Loading

Copy link
Copy Markdown
Member

bedevere-app Bot mentioned this pull request Aug 26, 2024
Closed
jaraco requested a review from sethmlarson August 26, 2024 17:47
jaraco added needs backport to 3.8 needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes labels Aug 26, 2024

jaraco commented Aug 26, 2024

Copy link
Copy Markdown
Member Author

Seth, I'm seeking your review on this for a couple of reasons.

  1. It's a tweak to a security fix, so needs to be applied to the same place. Do you agree this should be applied as an amendment to the previous security fix?

  2. It re-introduces potential vulnerabilities discussed here that were addressed by the original approach but also broke legitimate cases. Are you comfortable with more narrowly addressing the reported vulnerability (causing infinite loops) and leaving the other potential concerns to be addressed separately?

sethmlarson commented Aug 26, 2024

Copy link
Copy Markdown
Contributor

Thanks @jaraco, I'll take a look. Maybe you can clarify for me, the vulnerability only affects zipfile.Path and not zipfile.ZipFile methods using namelist, etc? If that's the case I need to update the advisory.

obfusk commented Aug 26, 2024

Copy link
Copy Markdown
Contributor

Maybe you can clarify for me, the vulnerability only affects zipfile.Path and not zipfile.ZipFile methods using namelist, etc? If that's the case I need to update the advisory.

FYI I wrote about that here: https://www.openwall.com/lists/oss-security/2024/08/23/2

jaraco commented Aug 26, 2024

Copy link
Copy Markdown
Member Author

Thanks @jaraco, I'll take a look. Maybe you can clarify for me, the vulnerability only affects zipfile.Path and not zipfile.ZipFile methods using namelist, etc? If that's the case I need to update the advisory.

That is correct.

jaraco merged commit 2231286 into python:main Aug 27, 2024

miss-islington-app Bot commented Aug 27, 2024

Copy link
Copy Markdown

Thanks @jaraco for the PR 🌮🎉.. I'm working now to backport this PR to: 3.8, 3.9, 3.10, 3.11, 3.12, 3.13.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Aug 27, 2024
pythongh-123270: Replaced SanitizedNames with a more surgical fix. (p…
88e9785 
…ythonGH-123354)

Applies changes from zipp 3.20.1 and jaraco/zippGH-124
(cherry picked from commit 2231286)

Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>

bedevere-app Bot commented Aug 27, 2024

Copy link
Copy Markdown

GH-123410 is a backport of this pull request to the 3.13 branch.

bedevere-app Bot removed the needs backport to 3.13 bugs and security fixes label Aug 27, 2024
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Aug 27, 2024
pythongh-123270: Replaced SanitizedNames with a more surgical fix. (p…
a2ee3af 
…ythonGH-123354)

Applies changes from zipp 3.20.1 and jaraco/zippGH-124
(cherry picked from commit 2231286)

Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>

miss-islington-app Bot commented Aug 27, 2024

Copy link
Copy Markdown

Sorry, @jaraco, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 2231286d78d328c2f575e0b05b16fe447d1656d6 3.11

bedevere-app Bot commented Aug 27, 2024

Copy link
Copy Markdown

GH-123411 is a backport of this pull request to the 3.12 branch.

bedevere-app Bot removed the needs backport to 3.12 only security fixes label Aug 27, 2024

miss-islington-app Bot commented Aug 27, 2024

Copy link
Copy Markdown

Sorry, @jaraco, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 2231286d78d328c2f575e0b05b16fe447d1656d6 3.10

miss-islington-app Bot commented Aug 27, 2024

Copy link
Copy Markdown

Sorry, @jaraco, I could not cleanly backport this to 3.9 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 2231286d78d328c2f575e0b05b16fe447d1656d6 3.9

miss-islington-app Bot commented Aug 27, 2024

Copy link
Copy Markdown

Sorry, @jaraco, I could not cleanly backport this to 3.8 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 2231286d78d328c2f575e0b05b16fe447d1656d6 3.8

jaraco mentioned this pull request Aug 27, 2024
Closed
jaraco mentioned this pull request Aug 27, 2024
Closed

sindhu-karri commented Aug 28, 2024

Copy link
Copy Markdown

@jaraco Could you please drive the backports to the previous versions as well. Waiting for both the original fix and surgical fix to go together in the 3.9 and 3.12 versions

jaraco commented Aug 28, 2024

Copy link
Copy Markdown
Member Author

@jaraco Could you please drive the backports to the previous versions as well. Waiting for both the original fix and surgical fix to go together in the 3.9 and 3.12 versions

Yes, absolutely.

jaraco mentioned this pull request Aug 28, 2024
Closed
jaraco added a commit to jaraco/cpython that referenced this pull request Aug 28, 2024
[3.11] pythongh-123270: Replaced SanitizedNames with a more surgical …
17b77bb 
…fix. (pythonGH-123354)

Applies changes from zipp 3.20.1 and jaraco/zippGH-124
(cherry picked from commit 2231286)

Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>

bedevere-app Bot commented Aug 28, 2024

Copy link
Copy Markdown

GH-123425 is a backport of this pull request to the 3.11 branch.

bedevere-app Bot removed the needs backport to 3.11 only security fixes label Aug 28, 2024
jaraco added a commit to jaraco/cpython that referenced this pull request Aug 28, 2024
[3.10] [3.11] pythongh-123270: Replaced SanitizedNames with a more su…
c94488e 
…rgical fix. (pythonGH-123354)

Applies changes from zipp 3.20.1 and jaraco/zippGH-124
(cherry picked from commit 2231286)
(cherry picked from commit 17b77bb)

Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>

bedevere-app Bot commented Aug 28, 2024

Copy link
Copy Markdown

GH-123426 is a backport of this pull request to the 3.10 branch.

bedevere-app Bot removed the needs backport to 3.10 only security fixes label Aug 28, 2024

jaraco commented Aug 28, 2024 •
edited
Loading

Copy link
Copy Markdown
Member Author

Unfortunately, I can't complete a backport to 3.8 or 3.9 because the diff depends on other PRs not yet merged:

I guess I could hand-resolve the combination of the two, but I feel a little uneasy doing that.

jaraco deleted the gh-123270/secure-allowed-names branch August 28, 2024 13:31
jaraco added a commit to jaraco/cpython that referenced this pull request Aug 28, 2024
[3.9] [3.11] pythongh-123270: Replaced SanitizedNames with a more sur…
66d3383 
…gical fix. (pythonGH-123354)

Applies changes from zipp 3.20.1 and jaraco/zippGH-124
(cherry picked from commit 2231286)
(cherry picked from commit 17b77bb)

Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>

bedevere-app Bot commented Aug 28, 2024

Copy link
Copy Markdown

GH-123432 is a backport of this pull request to the 3.9 branch.

jaraco added a commit to jaraco/cpython that referenced this pull request Aug 28, 2024
[3.8] [3.9] [3.11] pythongh-123270: Replaced SanitizedNames with a mo…
dcb320a 
…re surgical fix. (pythonGH-123354)

Applies changes from zipp 3.20.1 and jaraco/zippGH-124
(cherry picked from commit 2231286)
(cherry picked from commit 17b77bb)
(cherry picked from commit 66d3383)

Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>

bedevere-app Bot commented Aug 28, 2024

Copy link
Copy Markdown

GH-123433 is a backport of this pull request to the 3.8 branch.

Yhg1s pushed a commit that referenced this pull request Sep 2, 2024
[3.13] gh-123270: Replaced SanitizedNames with a more surgical fix. (G…
7e8883a 
…H-123354) (#123410)

gh-123270: Replaced SanitizedNames with a more surgical fix. (GH-123354)

Applies changes from zipp 3.20.1 and jaraco/zippGH-124
(cherry picked from commit 2231286)

Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>
jaraco added a commit that referenced this pull request Sep 2, 2024
[3.12] gh-123270: Replaced SanitizedNames with a more surgical fix. (G…
95b073b 
…H-123354) (#123411)

gh-123270: Replaced SanitizedNames with a more surgical fix. (GH-123354)

Applies changes from zipp 3.20.1 and jaraco/zippGH-124
(cherry picked from commit 2231286)

Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>
ambv pushed a commit that referenced this pull request Sep 4, 2024
[3.8] gh-123270: Replaced SanitizedNames with a more surgical fix. (G…
7bc367e 
…H-123354) (#123433)

Applies changes from zipp 3.20.1 and jaraco/zippGH-124
(cherry picked from commit 2231286)
(cherry picked from commit 17b77bb)
(cherry picked from commit 66d3383)

Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>
ambv pushed a commit that referenced this pull request Sep 4, 2024
[3.9] gh-123270: Replaced SanitizedNames with a more surgical fix. (G…
9620552 
…H-123354) (#123432)

Applies changes from zipp 3.20.1 and jaraco/zippGH-124
(cherry picked from commit 2231286)
(cherry picked from commit 17b77bb)

Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>
ambv pushed a commit that referenced this pull request Sep 4, 2024
[3.11] gh-123270: Replaced SanitizedNames with a more surgical fix. (G…
fc0b825 
…H-123354) (#123425)

Applies changes from zipp 3.20.1 and jaraco/zippGH-124
(cherry picked from commit 2231286)

Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>

* Restore the slash-prefixed paths in the malformed_paths test.
jaraco mentioned this pull request Sep 4, 2024
Merged
ambv pushed a commit that referenced this pull request Sep 4, 2024
[3.10] gh-123270: Replaced SanitizedNames with a more surgical fix. (G…
0aa1ee2 
…H-123354) (#123426)

Applies changes from zipp 3.20.1 and jaraco/zippGH-124
(cherry picked from commit 2231286)
(cherry picked from commit 17b77bb)

Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>
emontnemery mentioned this pull request Jan 27, 2026
Merged
21 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

sethmlarson sethmlarson approved these changes

Assignees

jaraco

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

Back | FazBrowse Home | New Git URL