<br><br><div class="gmail_quote">On Tue, Mar 29, 2011 at 4:07 PM, Terry Reedy <span dir="ltr"><<a href="mailto:tjreedy@udel.edu">tjreedy@udel.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class="im">On 3/29/2011 2:23 PM, Michael Foord wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Not sure how real the security risk is here:<br>
<br>
<a href="http://blog.omega-prime.co.uk/?p=107" target="_blank">http://blog.omega-prime.co.uk/?p=107</a><br>
<br>
Basically he is saying that if you store a list of blacklisted files<br>
with names encoded in big-5 (or some other non-utf8 compatible encoding)<br>
if those names are passed at the command line, or otherwise read in and<br>
decoded from an assumed-utf8 source with surrogate escaping, the<br>
surrogate escape decoded names will not match the properly decoded<br>
blacklisted names.<br>
</blockquote>
<br></div>
I posted link to this as comment, with my summary of thread.<br><font color="#888888">
<br>
-- <br>
Terry Jan Reedy</font></blockquote><div><br></div><div>I don't see your comment on the blog post. So either the author is moderating comments and hasn't seen yours yet (likely) or they don't want disagreement in their comments. ;)</div>
<div><br></div><div>Regardless, is isn't a bug with Python or PEP 383. If someone is dealing with security and does not know what formats the various inputs to their program that are used to make the security check can come in as they shouldn't be writing security oriented code at all... (But that's never stopped anyone).</div>
<meta charset="utf-8"><div><br></div><div>-gps</div><div><br></div></div>