Fix CVE-2023-24816 by removing legacy code....
Fix CVE-2023-24816 by removing legacy code.
Remove legacy code that might trigger a CVE.
Currently set_term_title is only called with (semi-)trusted input that
contain the current working directory of the current IPython session. If
an attacker can control directory names, and manage to get a user cd
into this directory the attacker can execute arbitrary commands
contained in the folder names.
Example:
- On a windows machine where python is built without _ctypes, create
a folder called && echo "pwn" > pwn.txt. This can be done by for
example cloning a git repository.
- call toggled_set_term_title(True), (or have the preference to
true)
- Open IPython and cd into this directory.
- the folder now contain a pwn.txt, with pwn as content, despite the
user not asking for any code execution.
Workaround:
Set the configuration option
c.TerminalInteractiveShell.term_title_format='IPython' (or to any
other fixed, safe string).
