152 lines
5.5 KiB
Diff
152 lines
5.5 KiB
Diff
From c3ea7d7def695cf09a07117b808da47639833954 Mon Sep 17 00:00:00 2001
|
|
From: Lumir Balhar <lbalhar@redhat.com>
|
|
Date: Wed, 22 Jan 2025 11:48:06 +0100
|
|
Subject: [PATCH] CVE-2024-56326
|
|
|
|
---
|
|
src/jinja2/sandbox.py | 65 +++++++++++++++++++++++-------------------
|
|
tests/test_security.py | 17 +++++++++++
|
|
2 files changed, 53 insertions(+), 29 deletions(-)
|
|
|
|
diff --git a/src/jinja2/sandbox.py b/src/jinja2/sandbox.py
|
|
index cfd7993..da26866 100644
|
|
--- a/src/jinja2/sandbox.py
|
|
+++ b/src/jinja2/sandbox.py
|
|
@@ -6,6 +6,7 @@ import operator
|
|
import types
|
|
import warnings
|
|
from collections import deque
|
|
+from functools import update_wrapper
|
|
from string import Formatter
|
|
|
|
from markupsafe import EscapeFormatter
|
|
@@ -153,16 +154,6 @@ class _MagicFormatMapping(abc.Mapping):
|
|
return len(self._kwargs)
|
|
|
|
|
|
-def inspect_format_method(callable):
|
|
- if not isinstance(
|
|
- callable, (types.MethodType, types.BuiltinMethodType)
|
|
- ) or callable.__name__ not in ("format", "format_map"):
|
|
- return None
|
|
- obj = callable.__self__
|
|
- if isinstance(obj, string_types):
|
|
- return obj
|
|
-
|
|
-
|
|
def safe_range(*args):
|
|
"""A range that can't generate ranges with a length of more than
|
|
MAX_RANGE items.
|
|
@@ -394,6 +385,9 @@ class SandboxedEnvironment(Environment):
|
|
except AttributeError:
|
|
pass
|
|
else:
|
|
+ fmt = self.wrap_str_format(value)
|
|
+ if fmt is not None:
|
|
+ return fmt
|
|
if self.is_safe_attribute(obj, argument, value):
|
|
return value
|
|
return self.unsafe_undefined(obj, argument)
|
|
@@ -411,6 +405,9 @@ class SandboxedEnvironment(Environment):
|
|
except (TypeError, LookupError):
|
|
pass
|
|
else:
|
|
+ fmt = self.wrap_str_format(value)
|
|
+ if fmt is not None:
|
|
+ return fmt
|
|
if self.is_safe_attribute(obj, attribute, value):
|
|
return value
|
|
return self.unsafe_undefined(obj, attribute)
|
|
@@ -426,34 +423,44 @@ class SandboxedEnvironment(Environment):
|
|
exc=SecurityError,
|
|
)
|
|
|
|
- def format_string(self, s, args, kwargs, format_func=None):
|
|
- """If a format call is detected, then this is routed through this
|
|
- method so that our safety sandbox can be used for it.
|
|
+ def wrap_str_format(self, value):
|
|
+ """If the given value is a ``str.format`` or ``str.format_map`` method,
|
|
+ return a new function than handles sandboxing. This is done at access
|
|
+ rather than in :meth:`call`, so that calls made without ``call`` are
|
|
+ also sandboxed.
|
|
"""
|
|
- if isinstance(s, Markup):
|
|
- formatter = SandboxedEscapeFormatter(self, s.escape)
|
|
+ if not isinstance(
|
|
+ value, (types.MethodType, types.BuiltinMethodType)
|
|
+ ) or value.__name__ not in ("format", "format_map"):
|
|
+ return None
|
|
+ f_self = value.__self__
|
|
+ if not isinstance(f_self, str):
|
|
+ return None
|
|
+ str_type = type(f_self)
|
|
+ is_format_map = value.__name__ == "format_map"
|
|
+ if isinstance(f_self, Markup):
|
|
+ formatter = SandboxedEscapeFormatter(self, escape=f_self.escape)
|
|
else:
|
|
formatter = SandboxedFormatter(self)
|
|
|
|
- if format_func is not None and format_func.__name__ == "format_map":
|
|
- if len(args) != 1 or kwargs:
|
|
- raise TypeError(
|
|
- "format_map() takes exactly one argument %d given"
|
|
- % (len(args) + (kwargs is not None))
|
|
- )
|
|
+ vformat = formatter.vformat
|
|
+ def wrapper(*args, **kwargs):
|
|
+ if is_format_map:
|
|
+ if kwargs:
|
|
+ raise TypeError("format_map() takes no keyword arguments")
|
|
+ if len(args) != 1:
|
|
+ raise TypeError(
|
|
+ f"format_map() takes exactly one argument ({len(args)} given)"
|
|
+ )
|
|
+ kwargs = args[0]
|
|
+ args = ()
|
|
|
|
- kwargs = args[0]
|
|
- args = None
|
|
+ return str_type(vformat(f_self, args, kwargs))
|
|
|
|
- kwargs = _MagicFormatMapping(args, kwargs)
|
|
- rv = formatter.vformat(s, args, kwargs)
|
|
- return type(s)(rv)
|
|
+ return update_wrapper(wrapper, value)
|
|
|
|
def call(__self, __context, __obj, *args, **kwargs): # noqa: B902
|
|
"""Call an object from sandboxed code."""
|
|
- fmt = inspect_format_method(__obj)
|
|
- if fmt is not None:
|
|
- return __self.format_string(fmt, args, kwargs, __obj)
|
|
|
|
# the double prefixes are to avoid double keyword argument
|
|
# errors when proxying the call.
|
|
diff --git a/tests/test_security.py b/tests/test_security.py
|
|
index 7e8974c..2e2af69 100644
|
|
--- a/tests/test_security.py
|
|
+++ b/tests/test_security.py
|
|
@@ -208,3 +208,20 @@ class TestStringFormatMap(object):
|
|
'{{ ("a{x.foo}b{y}"|safe).format_map({"x":{"foo": 42}, "y":"<foo>"}) }}'
|
|
)
|
|
assert t.render() == "a42b<foo>"
|
|
+
|
|
+ def test_indirect_call(self):
|
|
+ def run(value, arg):
|
|
+ return value.run(arg)
|
|
+
|
|
+ env = SandboxedEnvironment()
|
|
+ env.filters["run"] = run
|
|
+ t = env.from_string(
|
|
+ """{% set
|
|
+ ns = namespace(run="{0.__call__.__builtins__[__import__]}".format)
|
|
+ %}
|
|
+ {{ ns | run(not_here) }}
|
|
+ """
|
|
+ )
|
|
+
|
|
+ with pytest.raises(SecurityError):
|
|
+ t.render()
|
|
--
|
|
2.48.0
|
|
|