##// END OF EJS Templates
upstream » ipython
RSS

Clone from https://github.com/ipython/ipython.git

Fix CVE-2023-24816 by removing legacy code....
Fix CVE-2023-24816 by removing legacy code. Remove legacy code that might trigger a CVE. Currently set_term_title is only called with (semi-)trusted input that contain the current working directory of the current IPython session. If an attacker can control directory names, and manage to get a user cd into this directory the attacker can execute arbitrary commands contained in the folder names. Example: - On a windows machine where python is built without _ctypes, create a folder called && echo "pwn" > pwn.txt. This can be done by for example cloning a git repository. - call toggled_set_term_title(True), (or have the preference to true) - Open IPython and cd into this directory. - the folder now contain a pwn.txt, with pwn as content, despite the user not asking for any code execution. Workaround: Set the configuration option c.TerminalInteractiveShell.term_title_format='IPython' (or to any other fixed, safe string).
Matthias Bussonnier - - Load All Authors

File last commit:

r27747:f5d4e0ac
r28089:991849c2
Show More
test_splitinput.py
39 lines | 1.2 KiB | text/x-python | PythonLexer
/ IPython / core / tests / test_splitinput.py
History | Source | Raw |Copy content |Copy permalink
Thomas Kluyver
Update split_user_input unicode test.
 r4769 # coding: utf-8
Thomas Kluyver
Remove unused imports from IPython.core
 r11124
from IPython.core.splitinput import split_user_input, LineInfo
Thomas Kluyver
Reuse common code for inputsplitter and prefilter.
 r4746 from IPython.testing import tools as tt
tests = [
Samuel Gaist
[core][tests][splitinput] Remove nose
 r26909 ("x=1", ("", "", "x", "=1")),
("?", ("", "?", "", "")),
("??", ("", "??", "", "")),
(" ?", (" ", "?", "", "")),
(" ??", (" ", "??", "", "")),
("??x", ("", "??", "x", "")),
("?x=1", ("", "?", "x", "=1")),
("!ls", ("", "!", "ls", "")),
(" !ls", (" ", "!", "ls", "")),
("!!ls", ("", "!!", "ls", "")),
(" !!ls", (" ", "!!", "ls", "")),
(",ls", ("", ",", "ls", "")),
(";ls", ("", ";", "ls", "")),
(" ;ls", (" ", ";", "ls", "")),
("f.g(x)", ("", "", "f.g", "(x)")),
("f.g (x)", ("", "", "f.g", "(x)")),
("?%hist1", ("", "?", "%hist1", "")),
("?%%hist2", ("", "?", "%%hist2", "")),
("??%hist3", ("", "??", "%hist3", "")),
("??%%hist4", ("", "??", "%%hist4", "")),
("?x*", ("", "?", "x*", "")),
]
tests.append(("Pérez Fernando", ("", "", "Pérez", "Fernando")))
Thomas Kluyver
Reuse common code for inputsplitter and prefilter.
 r4746
def test_split_user_input():
return tt.check_pairs(split_user_input, tests)
Thomas Kluyver
Remove unused imports from IPython.core
 r11124
Matthias Bussonnier
MAINT: run black on files that ends up in a single line change....
 r27747
Thomas Kluyver
Remove unused imports from IPython.core
 r11124 def test_LineInfo():
"""Simple test for LineInfo construction and str()"""
Samuel Gaist
[core][tests][splitinput] Remove nose
 r26909 linfo = LineInfo(" %cd /home")
assert str(linfo) == "LineInfo [ |%|cd|/home]"