Skip to content

Commit

Permalink
main/python3: fix CVE-2024-8088
Browse files Browse the repository at this point in the history 
Add patch to fix CVE-2024-8088: Infinite loop when iterating over zip
archive entry names.

- python/cpython#122905
- https://mail.python.org/archives/list/[email protected]/thread/GNFCKVI4TCATKQLALJ5SN4L4CSPSMILU/
  • Loading branch information
Daniel Néri committed Aug 23, 2024
1 parent 7cecf6e commit e795bfc
Show file tree
Hide file tree
Showing 2 changed files with 146 additions and 1 deletion.
6 changes: 5 additions & 1 deletion main/python3/APKBUILD
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ pkgname=python3
pkgver=3.10.14
_bluez_ver=5.65
_basever="${pkgver%.*}"
pkgrel=1
pkgrel=2
pkgdesc="A high-level scripting language"
url="https://www.python.org/"
arch="all"
Expand Down Expand Up @@ -45,11 +45,14 @@ source="https://www.python.org/ftp/python/$pkgver/Python-$pkgver.tar.xz
musl-find_library.patch
custom-bluetooth-h-path.patch
arm-alignment.patch
CVE-2024-8088.patch
"
options="net" # Required for tests
builddir="$srcdir/Python-$pkgver"

# secfixes:
# 3.10.14-r2:
# - CVE-2024-8088
# 3.10.14-r0:
# - CVE-2024-0450
# - CVE-2023-6597
Expand Down Expand Up @@ -241,4 +244,5 @@ fe123dd871f7a3fa868c499a957b94f1d815a1e1de964aaff1116c579defd4d9d1e9b7eb418cf114
ab8eaa2858d5109049b1f9f553198d40e0ef8d78211ad6455f7b491af525bffb16738fed60fc84e960c4889568d25753b9e4a1494834fea48291b33f07000ec2 musl-find_library.patch
14b00953cdb5fe757b38dbf759d7203c3504b46e330494ec195db92290640ec640fb29cc4456208a25dadc028ebaf211b0df71f458a3b76023fdafb4f91ff46a custom-bluetooth-h-path.patch
a84483246e413650a904c34c18f5e4f4168c39067d069f48557c330de6eb3db19fd96a4d453d742db3dcb7c7f962722903f62823c752ff90510c89830435ffc0 arm-alignment.patch
ddc6eb01847a987d0833c28ce4d340848401d353b76534cc5ca2a68d11efe9e3bf5af66ab830a1ea14f14d07ad985e62729a1abef1ca7e2e017906258dbee24d CVE-2024-8088.patch
"
141 changes: 141 additions & 0 deletions main/python3/CVE-2024-8088.patch
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,141 @@
From d82745ed652414fc5c4e18b90b815382a902c226 Mon Sep 17 00:00:00 2001
From: "Jason R. Coombs" <[email protected]>
Date: Mon, 19 Aug 2024 19:28:20 -0400
Subject: [PATCH] [3.10] [3.11] gh-122905: Sanitize names in zipfile.Path.
(GH-122906) (GH-122925)

* gh-122905: Sanitize names in zipfile.Path. (GH-122906)

Ported from zipp 3.19.1; ref jaraco/zippGH-119.

(cherry picked from commit 9cd03263100ddb1657826cc4a71470786cab3932)

* [3.11] gh-122905: Sanitize names in zipfile.Path. (GH-122906)

Ported from zipp 3.19.1; ref jaraco/zippGH-119.
(cherry picked from commit 9cd03263100ddb1657826cc4a71470786cab3932)

(cherry picked from commit 795f2597a4be988e2bb19b69ff9958e981cb894e)

Co-authored-by: Jason R. Coombs <[email protected]>
---
Lib/test/test_zipfile.py | 17 ++++++
Lib/zipfile.py | 61 ++++++++++++++++++-
...-08-11-14-08-04.gh-issue-122905.7tDsxA.rst | 1 +
3 files changed, 78 insertions(+), 1 deletion(-)
create mode 100644 Misc/NEWS.d/next/Library/2024-08-11-14-08-04.gh-issue-122905.7tDsxA.rst

diff --git a/Lib/test/test_zipfile.py b/Lib/test/test_zipfile.py
index 32c01704d9d1d6..a60dc11688d20b 100644
--- a/Lib/test/test_zipfile.py
+++ b/Lib/test/test_zipfile.py
@@ -3280,6 +3280,23 @@ def test_extract_orig_with_implied_dirs(self, alpharep):
zipfile.Path(zf)
zf.extractall(source_path.parent)

+ def test_malformed_paths(self):
+ """
+ Path should handle malformed paths.
+ """
+ data = io.BytesIO()
+ zf = zipfile.ZipFile(data, "w")
+ zf.writestr("/one-slash.txt", b"content")
+ zf.writestr("//two-slash.txt", b"content")
+ zf.writestr("../parent.txt", b"content")
+ zf.filename = ''
+ root = zipfile.Path(zf)
+ assert list(map(str, root.iterdir())) == [
+ 'one-slash.txt',
+ 'two-slash.txt',
+ 'parent.txt',
+ ]
+

class StripExtraTests(unittest.TestCase):
# Note: all of the "z" characters are technically invalid, but up
diff --git a/Lib/zipfile.py b/Lib/zipfile.py
index 7d18bc2479fcda..cbac8d9160e72b 100644
--- a/Lib/zipfile.py
+++ b/Lib/zipfile.py
@@ -9,6 +9,7 @@
import itertools
import os
import posixpath
+import re
import shutil
import stat
import struct
@@ -2182,7 +2183,65 @@ def _difference(minuend, subtrahend):
return itertools.filterfalse(set(subtrahend).__contains__, minuend)


-class CompleteDirs(ZipFile):
+class SanitizedNames:
+ """
+ ZipFile mix-in to ensure names are sanitized.
+ """
+
+ def namelist(self):
+ return list(map(self._sanitize, super().namelist()))
+
+ @staticmethod
+ def _sanitize(name):
+ r"""
+ Ensure a relative path with posix separators and no dot names.
+ Modeled after
+ https://github.com/python/cpython/blob/bcc1be39cb1d04ad9fc0bd1b9193d3972835a57c/Lib/zipfile/__init__.py#L1799-L1813
+ but provides consistent cross-platform behavior.
+ >>> san = SanitizedNames._sanitize
+ >>> san('/foo/bar')
+ 'foo/bar'
+ >>> san('//foo.txt')
+ 'foo.txt'
+ >>> san('foo/.././bar.txt')
+ 'foo/bar.txt'
+ >>> san('foo../.bar.txt')
+ 'foo../.bar.txt'
+ >>> san('\\foo\\bar.txt')
+ 'foo/bar.txt'
+ >>> san('D:\\foo.txt')
+ 'D/foo.txt'
+ >>> san('\\\\server\\share\\file.txt')
+ 'server/share/file.txt'
+ >>> san('\\\\?\\GLOBALROOT\\Volume3')
+ '?/GLOBALROOT/Volume3'
+ >>> san('\\\\.\\PhysicalDrive1\\root')
+ 'PhysicalDrive1/root'
+ Retain any trailing slash.
+ >>> san('abc/')
+ 'abc/'
+ Raises a ValueError if the result is empty.
+ >>> san('../..')
+ Traceback (most recent call last):
+ ...
+ ValueError: Empty filename
+ """
+
+ def allowed(part):
+ return part and part not in {'..', '.'}
+
+ # Remove the drive letter.
+ # Don't use ntpath.splitdrive, because that also strips UNC paths
+ bare = re.sub('^([A-Z]):', r'\1', name, flags=re.IGNORECASE)
+ clean = bare.replace('\\', '/')
+ parts = clean.split('/')
+ joined = '/'.join(filter(allowed, parts))
+ if not joined:
+ raise ValueError("Empty filename")
+ return joined + '/' * name.endswith('/')
+
+
+class CompleteDirs(SanitizedNames, ZipFile):
"""
A ZipFile subclass that ensures that implied directories
are always included in the namelist.
diff --git a/Misc/NEWS.d/next/Library/2024-08-11-14-08-04.gh-issue-122905.7tDsxA.rst b/Misc/NEWS.d/next/Library/2024-08-11-14-08-04.gh-issue-122905.7tDsxA.rst
new file mode 100644
index 00000000000000..1be44c906c4f30
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2024-08-11-14-08-04.gh-issue-122905.7tDsxA.rst
@@ -0,0 +1 @@
+:class:`zipfile.Path` objects now sanitize names from the zipfile.

0 comments on commit e795bfc

Please sign in to comment.