upstream/ipython Files · IPython/core/error.py

Fix CVE-2023-24816 by removing legacy code....

Fix CVE-2023-24816 by removing legacy code. Remove legacy code that might trigger a CVE. Currently set_term_title is only called with (semi-)trusted input that contain the current working directory of the current IPython session. If an attacker can control directory names, and manage to get a user cd into this directory the attacker can execute arbitrary commands contained in the folder names. Example: - On a windows machine where python is built without _ctypes, create a folder called && echo "pwn" > pwn.txt. This can be done by for example cloning a git repository. - call toggled_set_term_title(True), (or have the preference to true) - Open IPython and cd into this directory. - the folder now contain a pwn.txt, with pwn as content, despite the user not asking for any code execution. Workaround: Set the configuration option c.TerminalInteractiveShell.term_title_format='IPython' (or to any other fixed, safe string).

Scott Sanderson - - Load All Authors

File last commit:

r17799:40708d45


                r28089:991849c2

Download file

             error.py
        
                    60 lines
            
             | 1.7 KiB
            
                | text/x-python
            
             |
                PythonLexer
            
             / IPython / core / error.py
          
                    History
                
                 |
                  Annotation
                 | Raw
                 |Copy content
                 |Copy permalink

      # encoding: utf-8

      """

      Global exception classes for IPython.core.

      Authors:

      * Brian Granger

      * Fernando Perez

      * Min Ragan-Kelley

      Notes

      -----

      """

      #-----------------------------------------------------------------------------

      #  Copyright (C) 2008 The IPython Development Team

      #

      #  Distributed under the terms of the BSD License.  The full license is in

      #  the file COPYING, distributed as part of this software.

      #-----------------------------------------------------------------------------

      #-----------------------------------------------------------------------------

      # Imports

      #-----------------------------------------------------------------------------

      #-----------------------------------------------------------------------------

      # Exception classes

      #-----------------------------------------------------------------------------

      class IPythonCoreError(Exception):

          pass

      class TryNext(IPythonCoreError):

          """Try next hook exception.

          Raise this in your hook function to indicate that the next hook handler

          should be used to handle the operation.

          """

      class UsageError(IPythonCoreError):

          """Error in magic function arguments, etc.

          Something that probably won't warrant a full traceback, but should

          nevertheless interrupt a macro / batch file.

          """

      class StdinNotImplementedError(IPythonCoreError, NotImplementedError):

          """raw_input was requested in a context where it is not supported

          For use in IPython kernels, where only some frontends may support

          stdin requests.

          """

      class InputRejected(Exception):

          """Input rejected by ast transformer.

          Raise this in your NodeTransformer to indicate that InteractiveShell should

          not execute the supplied input.

          """

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages

				# encoding: utf-8
				"""
				Global exception classes for IPython.core.

				Authors:

				* Brian Granger
				* Fernando Perez
				* Min Ragan-Kelley

				Notes
				-----
				"""

				#-----------------------------------------------------------------------------
				# Copyright (C) 2008 The IPython Development Team
				#
				# Distributed under the terms of the BSD License. The full license is in
				# the file COPYING, distributed as part of this software.
				#-----------------------------------------------------------------------------

				#-----------------------------------------------------------------------------
				# Imports
				#-----------------------------------------------------------------------------

				#-----------------------------------------------------------------------------
				# Exception classes
				#-----------------------------------------------------------------------------

				class IPythonCoreError(Exception):
				pass


				class TryNext(IPythonCoreError):
				"""Try next hook exception.

				Raise this in your hook function to indicate that the next hook handler
				should be used to handle the operation.
				"""

				class UsageError(IPythonCoreError):
				"""Error in magic function arguments, etc.

				Something that probably won't warrant a full traceback, but should
				nevertheless interrupt a macro / batch file.
				"""

				class StdinNotImplementedError(IPythonCoreError, NotImplementedError):
				"""raw_input was requested in a context where it is not supported

				For use in IPython kernels, where only some frontends may support
				stdin requests.
				"""

				class InputRejected(Exception):
				"""Input rejected by ast transformer.

				Raise this in your NodeTransformer to indicate that InteractiveShell should
				not execute the supplied input.
				"""