upstream/ipython Files · IPython/utils/tests/test_openpy.py

Fix CVE-2023-24816 by removing legacy code....

Fix CVE-2023-24816 by removing legacy code. Remove legacy code that might trigger a CVE. Currently set_term_title is only called with (semi-)trusted input that contain the current working directory of the current IPython session. If an attacker can control directory names, and manage to get a user cd into this directory the attacker can execute arbitrary commands contained in the folder names. Example: - On a windows machine where python is built without _ctypes, create a folder called && echo "pwn" > pwn.txt. This can be done by for example cloning a git repository. - call toggled_set_term_title(True), (or have the preference to true) - Open IPython and cd into this directory. - the folder now contain a pwn.txt, with pwn as content, despite the user not asking for any code execution. Workaround: Set the configuration option c.TerminalInteractiveShell.term_title_format='IPython' (or to any other fixed, safe string).

Samuel Gaist - - Load All Authors

File last commit:

r26922:9c38a13d


                r28089:991849c2

Download file

             test_openpy.py
        
                    38 lines
            
             | 1.2 KiB
            
                | text/x-python
            
             |
                PythonLexer
            
             / IPython / utils / tests / test_openpy.py
          
                    History
                
                 |
                  Annotation
                 | Raw
                 |Copy content
                 |Copy permalink

      import io

      import os.path

      from IPython.utils import openpy

      mydir = os.path.dirname(__file__)

      nonascii_path = os.path.join(mydir, "../../core/tests/nonascii.py")

      def test_detect_encoding():

          with open(nonascii_path, "rb") as f:

              enc, lines = openpy.detect_encoding(f.readline)

          assert enc == "iso-8859-5"

      def test_read_file():

          with io.open(nonascii_path, encoding="iso-8859-5") as f:

              read_specified_enc = f.read()

          read_detected_enc = openpy.read_py_file(nonascii_path, skip_encoding_cookie=False)

          assert read_detected_enc == read_specified_enc

          assert "coding: iso-8859-5" in read_detected_enc

          read_strip_enc_cookie = openpy.read_py_file(

              nonascii_path, skip_encoding_cookie=True

          )

          assert "coding: iso-8859-5" not in read_strip_enc_cookie

      def test_source_to_unicode():

          with io.open(nonascii_path, "rb") as f:

              source_bytes = f.read()

          assert (

              openpy.source_to_unicode(source_bytes, skip_encoding_cookie=False).splitlines()

              == source_bytes.decode("iso-8859-5").splitlines()

          )

          source_no_cookie = openpy.source_to_unicode(source_bytes, skip_encoding_cookie=True)

          assert "coding: iso-8859-5" not in source_no_cookie

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages

				import io
				import os.path

				from IPython.utils import openpy

				mydir = os.path.dirname(__file__)
				nonascii_path = os.path.join(mydir, "../../core/tests/nonascii.py")


				def test_detect_encoding():
				with open(nonascii_path, "rb") as f:
				enc, lines = openpy.detect_encoding(f.readline)
				assert enc == "iso-8859-5"


				def test_read_file():
				with io.open(nonascii_path, encoding="iso-8859-5") as f:
				read_specified_enc = f.read()
				read_detected_enc = openpy.read_py_file(nonascii_path, skip_encoding_cookie=False)
				assert read_detected_enc == read_specified_enc
				assert "coding: iso-8859-5" in read_detected_enc

				read_strip_enc_cookie = openpy.read_py_file(
				nonascii_path, skip_encoding_cookie=True
				)
				assert "coding: iso-8859-5" not in read_strip_enc_cookie


				def test_source_to_unicode():
				with io.open(nonascii_path, "rb") as f:
				source_bytes = f.read()
				assert (
				openpy.source_to_unicode(source_bytes, skip_encoding_cookie=False).splitlines()
				== source_bytes.decode("iso-8859-5").splitlines()
				)

				source_no_cookie = openpy.source_to_unicode(source_bytes, skip_encoding_cookie=True)
				assert "coding: iso-8859-5" not in source_no_cookie