upstream/ipython Files · IPython/core/tests/simpleerr.py

Fix CVE-2023-24816 by removing legacy code....

Fix CVE-2023-24816 by removing legacy code. Remove legacy code that might trigger a CVE. Currently set_term_title is only called with (semi-)trusted input that contain the current working directory of the current IPython session. If an attacker can control directory names, and manage to get a user cd into this directory the attacker can execute arbitrary commands contained in the folder names. Example: - On a windows machine where python is built without _ctypes, create a folder called && echo "pwn" > pwn.txt. This can be done by for example cloning a git repository. - call toggled_set_term_title(True), (or have the preference to true) - Open IPython and cd into this directory. - the folder now contain a pwn.txt, with pwn as content, despite the user not asking for any code execution. Workaround: Set the configuration option c.TerminalInteractiveShell.term_title_format='IPython' (or to any other fixed, safe string).

Matthias Bussonnier - - Load All Authors

File last commit:

r27004:31a08778


                r28089:991849c2

Download file

             simpleerr.py
        
                    33 lines
            
             | 583 B
            
                | text/x-python
            
             |
                PythonLexer
            
             / IPython / core / tests / simpleerr.py
          
                    History
                
                 |
                  Annotation
                 | Raw
                 |Copy content
                 |Copy permalink

      """Error script. DO NOT EDIT FURTHER! It will break exception doctests!!!"""

      import sys

      def div0():

          "foo"

          x = 1

          y = 0

          x/y

      def sysexit(stat, mode):

          raise SystemExit(stat, f"Mode = {mode}")

      def bar(mode):

          "bar"

          if mode=='div':

              div0()

          elif mode=='exit':

              try:

                  stat = int(sys.argv[2])

              except:

                  stat = 1

              sysexit(stat, mode)

          else:

              raise ValueError('Unknown mode')

      if __name__ == '__main__':

          try:

              mode = sys.argv[1]

          except IndexError:

              mode = 'div'

          bar(mode)

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages

				"""Error script. DO NOT EDIT FURTHER! It will break exception doctests!!!"""
				import sys

				def div0():
				"foo"
				x = 1
				y = 0
				x/y

				def sysexit(stat, mode):
				raise SystemExit(stat, f"Mode = {mode}")


				def bar(mode):
				"bar"
				if mode=='div':
				div0()
				elif mode=='exit':
				try:
				stat = int(sys.argv[2])
				except:
				stat = 1
				sysexit(stat, mode)
				else:
				raise ValueError('Unknown mode')

				if __name__ == '__main__':
				try:
				mode = sys.argv[1]
				except IndexError:
				mode = 'div'

				bar(mode)