upstream/ipython Files · IPython/core/tests/test_imports.py

Fix CVE-2023-24816 by removing legacy code....

Fix CVE-2023-24816 by removing legacy code. Remove legacy code that might trigger a CVE. Currently set_term_title is only called with (semi-)trusted input that contain the current working directory of the current IPython session. If an attacker can control directory names, and manage to get a user cd into this directory the attacker can execute arbitrary commands contained in the folder names. Example: - On a windows machine where python is built without _ctypes, create a folder called && echo "pwn" > pwn.txt. This can be done by for example cloning a git repository. - call toggled_set_term_title(True), (or have the preference to true) - Open IPython and cd into this directory. - the folder now contain a pwn.txt, with pwn as content, despite the user not asking for any code execution. Workaround: Set the configuration option c.TerminalInteractiveShell.term_title_format='IPython' (or to any other fixed, safe string).

Matthias Bussonnier - - Load All Authors

File last commit:

r23703:d7af1ed2


                r28089:991849c2

Download file

             test_imports.py
        
                    52 lines
            
             | 1.1 KiB
            
                | text/x-python
            
             |
                PythonLexer
            
             / IPython / core / tests / test_imports.py
          
                    History
                
                 |
                  Annotation
                 | Raw
                 |Copy content
                 |Copy permalink

      # encoding: utf-8

      def test_import_completer():

          from IPython.core import completer

      def test_import_crashhandler():

          from IPython.core import crashhandler

      def test_import_debugger():

          from IPython.core import debugger

      def test_import_excolors():

          from IPython.core import excolors

      def test_import_history():

          from IPython.core import history

      def test_import_hooks():

          from IPython.core import hooks

      def test_import_getipython():

          from IPython.core import getipython

      def test_import_interactiveshell():

          from IPython.core import interactiveshell

      def test_import_logger():

          from IPython.core import logger

      def test_import_macro():

          from IPython.core import macro

      def test_import_magic():

          from IPython.core import magic

      def test_import_oinspect():

          from IPython.core import oinspect

      def test_import_prefilter():

          from IPython.core import prefilter

      def test_import_prompts():

          from IPython.core import prompts

      def test_import_release():

          from IPython.core import release

      def test_import_ultratb():

          from IPython.core import ultratb

      def test_import_usage():

          from IPython.core import usage

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages

				# encoding: utf-8

				def test_import_completer():
				from IPython.core import completer

				def test_import_crashhandler():
				from IPython.core import crashhandler

				def test_import_debugger():
				from IPython.core import debugger

				def test_import_excolors():
				from IPython.core import excolors

				def test_import_history():
				from IPython.core import history

				def test_import_hooks():
				from IPython.core import hooks

				def test_import_getipython():
				from IPython.core import getipython

				def test_import_interactiveshell():
				from IPython.core import interactiveshell

				def test_import_logger():
				from IPython.core import logger

				def test_import_macro():
				from IPython.core import macro

				def test_import_magic():
				from IPython.core import magic

				def test_import_oinspect():
				from IPython.core import oinspect

				def test_import_prefilter():
				from IPython.core import prefilter

				def test_import_prompts():
				from IPython.core import prompts

				def test_import_release():
				from IPython.core import release

				def test_import_ultratb():
				from IPython.core import ultratb

				def test_import_usage():
				from IPython.core import usage