152 lines
5.8 KiB
Diff
152 lines
5.8 KiB
Diff
From 2df1f7886e9e87face85569d5794ba690932c382 Mon Sep 17 00:00:00 2001
|
|
From: Lumir Balhar <lbalhar@redhat.com>
|
|
Date: Wed, 22 Jan 2025 12:37:29 +0100
|
|
Subject: [PATCH] CVE-2024-56326
|
|
|
|
---
|
|
Jinja2-2.10.1/jinja2/sandbox.py | 65 +++++++++++++++-------------
|
|
Jinja2-2.10.1/tests/test_security.py | 17 ++++++++
|
|
2 files changed, 53 insertions(+), 29 deletions(-)
|
|
|
|
diff --git a/Jinja2-2.10.1/jinja2/sandbox.py b/Jinja2-2.10.1/jinja2/sandbox.py
|
|
index 752e812..5516f96 100644
|
|
--- a/Jinja2-2.10.1/jinja2/sandbox.py
|
|
+++ b/Jinja2-2.10.1/jinja2/sandbox.py
|
|
@@ -15,6 +15,7 @@
|
|
import types
|
|
import operator
|
|
from collections import Mapping
|
|
+from functools import update_wrapper
|
|
from jinja2.environment import Environment
|
|
from jinja2.exceptions import SecurityError
|
|
from jinja2._compat import string_types, PY2
|
|
@@ -134,16 +135,6 @@ class _MagicFormatMapping(Mapping):
|
|
return len(self._kwargs)
|
|
|
|
|
|
-def inspect_format_method(callable):
|
|
- if not isinstance(callable, (types.MethodType,
|
|
- types.BuiltinMethodType)) or \
|
|
- callable.__name__ not in ('format', 'format_map'):
|
|
- return None
|
|
- obj = callable.__self__
|
|
- if isinstance(obj, string_types):
|
|
- return obj
|
|
-
|
|
-
|
|
def safe_range(*args):
|
|
"""A range that can't generate ranges with a length of more than
|
|
MAX_RANGE items.
|
|
@@ -372,6 +363,9 @@ class SandboxedEnvironment(Environment):
|
|
except AttributeError:
|
|
pass
|
|
else:
|
|
+ fmt = self.wrap_str_format(value)
|
|
+ if fmt is not None:
|
|
+ return fmt
|
|
if self.is_safe_attribute(obj, argument, value):
|
|
return value
|
|
return self.unsafe_undefined(obj, argument)
|
|
@@ -389,6 +383,9 @@ class SandboxedEnvironment(Environment):
|
|
except (TypeError, LookupError):
|
|
pass
|
|
else:
|
|
+ fmt = self.wrap_str_format(value)
|
|
+ if fmt is not None:
|
|
+ return fmt
|
|
if self.is_safe_attribute(obj, attribute, value):
|
|
return value
|
|
return self.unsafe_undefined(obj, attribute)
|
|
@@ -402,34 +399,44 @@ class SandboxedEnvironment(Environment):
|
|
obj.__class__.__name__
|
|
), name=attribute, obj=obj, exc=SecurityError)
|
|
|
|
- def format_string(self, s, args, kwargs, format_func=None):
|
|
- """If a format call is detected, then this is routed through this
|
|
- method so that our safety sandbox can be used for it.
|
|
+ def wrap_str_format(self, value):
|
|
+ """If the given value is a ``str.format`` or ``str.format_map`` method,
|
|
+ return a new function than handles sandboxing. This is done at access
|
|
+ rather than in :meth:`call`, so that calls made without ``call`` are
|
|
+ also sandboxed.
|
|
"""
|
|
- if isinstance(s, Markup):
|
|
- formatter = SandboxedEscapeFormatter(self, s.escape)
|
|
+ if not isinstance(
|
|
+ value, (types.MethodType, types.BuiltinMethodType)
|
|
+ ) or value.__name__ not in ("format", "format_map"):
|
|
+ return None
|
|
+ f_self = value.__self__
|
|
+ if not isinstance(f_self, str):
|
|
+ return None
|
|
+ str_type = type(f_self)
|
|
+ is_format_map = value.__name__ == "format_map"
|
|
+ if isinstance(f_self, Markup):
|
|
+ formatter = SandboxedEscapeFormatter(self, escape=f_self.escape)
|
|
else:
|
|
formatter = SandboxedFormatter(self)
|
|
|
|
- if format_func is not None and format_func.__name__ == 'format_map':
|
|
- if len(args) != 1 or kwargs:
|
|
- raise TypeError(
|
|
- 'format_map() takes exactly one argument %d given'
|
|
- % (len(args) + (kwargs is not None))
|
|
- )
|
|
+ vformat = formatter.vformat
|
|
+ def wrapper(*args, **kwargs):
|
|
+ if is_format_map:
|
|
+ if kwargs:
|
|
+ raise TypeError("format_map() takes no keyword arguments")
|
|
+ if len(args) != 1:
|
|
+ raise TypeError(
|
|
+ f"format_map() takes exactly one argument ({len(args)} given)"
|
|
+ )
|
|
+ kwargs = args[0]
|
|
+ args = ()
|
|
|
|
- kwargs = args[0]
|
|
- args = None
|
|
+ return str_type(vformat(f_self, args, kwargs))
|
|
|
|
- kwargs = _MagicFormatMapping(args, kwargs)
|
|
- rv = formatter.vformat(s, args, kwargs)
|
|
- return type(s)(rv)
|
|
+ return update_wrapper(wrapper, value)
|
|
|
|
def call(__self, __context, __obj, *args, **kwargs):
|
|
"""Call an object from sandboxed code."""
|
|
- fmt = inspect_format_method(__obj)
|
|
- if fmt is not None:
|
|
- return __self.format_string(fmt, args, kwargs, __obj)
|
|
|
|
# the double prefixes are to avoid double keyword argument
|
|
# errors when proxying the call.
|
|
diff --git a/Jinja2-2.10.1/tests/test_security.py b/Jinja2-2.10.1/tests/test_security.py
|
|
index 5c8639c..1719644 100644
|
|
--- a/Jinja2-2.10.1/tests/test_security.py
|
|
+++ b/Jinja2-2.10.1/tests/test_security.py
|
|
@@ -206,3 +206,20 @@ class TestStringFormatMap(object):
|
|
env = SandboxedEnvironment()
|
|
t = env.from_string('{{ ("a{x.foo}b{y}"|safe).format_map({"x":{"foo": 42}, "y":"<foo>"}) }}')
|
|
assert t.render() == 'a42b<foo>'
|
|
+
|
|
+ def test_indirect_call(self):
|
|
+ def run(value, arg):
|
|
+ return value.run(arg)
|
|
+
|
|
+ env = SandboxedEnvironment()
|
|
+ env.filters["run"] = run
|
|
+ t = env.from_string(
|
|
+ """{% set
|
|
+ ns = namespace(run="{0.__call__.__builtins__[__import__]}".format)
|
|
+ %}
|
|
+ {{ ns | run(not_here) }}
|
|
+ """
|
|
+ )
|
|
+
|
|
+ with pytest.raises(SecurityError):
|
|
+ t.render()
|
|
--
|
|
2.48.0
|
|
|