Mailman 3 February 2005 - Python-checkins

python/dist/src/Lib/xml/sax saxutils.py, 1.25, 1.26
by fdrake＠users.sourceforge.net Feb. 3, 2005

Feb. 3, 2005

Update of /cvsroot/python/python/dist/src/Lib/xml/sax In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv16764 Modified Files: saxutils.py Log Message: fix XMLFilterBase.resolveEntity() so the caller gets the result (PyXML bug #1112052) Index: saxutils.py =================================================================== RCS file: /cvsroot/python/python/dist/src/Lib/xml/sax/saxutils.py,v retrieving revision 1.25 retrieving revision 1.26 diff -u -d -r1.25 -r1.26 --- saxutils.py 20 Oct 2004 11:08:35 -0000 1.25 +++ saxutils.py 3 Feb 2005 17:31:39 -0000 1.26 @@ -232,7 +232,7 @@ # EntityResolver methods def resolveEntity(self, publicId, systemId): - self._ent_handler.resolveEntity(publicId, systemId) + return self._ent_handler.resolveEntity(publicId, systemId) # XMLReader methods

1 0

python/dist/src/Lib/xml/sax saxutils.py, 1.25, 1.25.2.1
by fdrake＠users.sourceforge.net Feb. 3, 2005

Feb. 3, 2005

Update of /cvsroot/python/python/dist/src/Lib/xml/sax In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv16596 Modified Files: Tag: release24-maint saxutils.py Log Message: fix XMLFilterBase.resolveEntity() so the caller gets the result (PyXML bug #1112052) Index: saxutils.py =================================================================== RCS file: /cvsroot/python/python/dist/src/Lib/xml/sax/saxutils.py,v retrieving revision 1.25 retrieving revision 1.25.2.1 diff -u -d -r1.25 -r1.25.2.1 --- saxutils.py 20 Oct 2004 11:08:35 -0000 1.25 +++ saxutils.py 3 Feb 2005 17:30:46 -0000 1.25.2.1 @@ -232,7 +232,7 @@ # EntityResolver methods def resolveEntity(self, publicId, systemId): - self._ent_handler.resolveEntity(publicId, systemId) + return self._ent_handler.resolveEntity(publicId, systemId) # XMLReader methods

1 0

[Python-checkins] python/dist/src/Lib/xml/sax saxutils.py, 1.21.10.2, 1.21.10.3
by fdrake＠users.sourceforge.net Feb. 3, 2005

Feb. 3, 2005

Update of /cvsroot/python/python/dist/src/Lib/xml/sax In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv16302 Modified Files: Tag: release23-maint saxutils.py Log Message: fix XMLFilterBase.resolveEntity() so the caller gets the result (PyXML bug #1112052) Index: saxutils.py =================================================================== RCS file: /cvsroot/python/python/dist/src/Lib/xml/sax/saxutils.py,v retrieving revision 1.21.10.2 retrieving revision 1.21.10.3 diff -u -d -r1.21.10.2 -r1.21.10.3 --- saxutils.py 6 May 2004 02:22:23 -0000 1.21.10.2 +++ saxutils.py 3 Feb 2005 17:29:32 -0000 1.21.10.3 @@ -232,7 +232,7 @@ # EntityResolver methods def resolveEntity(self, publicId, systemId): - self._ent_handler.resolveEntity(publicId, systemId) + return self._ent_handler.resolveEntity(publicId, systemId) # XMLReader methods

1 0

python/dist/src/Misc NEWS,1.1236,1.1237
by gvanrossum＠users.sourceforge.net Feb. 3, 2005

Feb. 3, 2005

Update of /cvsroot/python/python/dist/src/Misc In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv15460/Misc Modified Files: NEWS Log Message: Security fix PSF-2005-001 for SimpleXMLRPCServer.py. Index: NEWS =================================================================== RCS file: /cvsroot/python/python/dist/src/Misc/NEWS,v retrieving revision 1.1236 retrieving revision 1.1237 diff -u -d -r1.1236 -r1.1237 --- NEWS 31 Jan 2005 17:09:20 -0000 1.1236 +++ NEWS 3 Feb 2005 15:01:24 -0000 1.1237 @@ -47,6 +47,10 @@ Library ------- +- Applied a security fix to SimpleXMLRPCserver (PSF-2005-001). This + disables recursive traversal through instance attributes, which can + be exploited in various ways. + - Bug #1110478: Revert os.environ.update to do putenv again. - Bug #1103844: fix distutils.install.dump_dirs() with negated options.

1 0

python/dist/src/Doc/lib libsimplexmlrpc.tex, 1.8, 1.9
by gvanrossum＠users.sourceforge.net Feb. 3, 2005

Feb. 3, 2005

Update of /cvsroot/python/python/dist/src/Doc/lib In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv15460/Doc/lib Modified Files: libsimplexmlrpc.tex Log Message: Security fix PSF-2005-001 for SimpleXMLRPCServer.py. Index: libsimplexmlrpc.tex =================================================================== RCS file: /cvsroot/python/python/dist/src/Doc/lib/libsimplexmlrpc.tex,v retrieving revision 1.8 retrieving revision 1.9 diff -u -d -r1.8 -r1.9 --- libsimplexmlrpc.tex 1 Dec 2004 18:34:11 -0000 1.8 +++ libsimplexmlrpc.tex 3 Feb 2005 15:01:23 -0000 1.9 @@ -55,7 +55,8 @@ period character. \end{methoddesc} -\begin{methoddesc}[SimpleXMLRPCServer]{register_instance}{instance} +\begin{methoddesc}[SimpleXMLRPCServer]{register_instance}{instance\optional{, + allow_dotted_names}} Register an object which is used to expose method names which have not been registered using \method{register_function()}. If \var{instance} contains a \method{_dispatch()} method, it is called @@ -67,12 +68,26 @@ The return value from \method{_dispatch()} is returned to the client as the result. If \var{instance} does not have a \method{_dispatch()} method, it is - searched for an attribute matching the name of the requested method; + searched for an attribute matching the name of the requested method. + + If the optional \var{allow_dotted_names} argument is true and the + instance does not have a \method{_dispatch()} method, then if the requested method name contains periods, each component of the method name is searched for individually, with the effect that a simple hierarchical search is performed. The value found from this search is then called with the parameters from the request, and the return value is passed back to the client. + + \begin{notice}[warning] + Enabling the \var{allow_dotted_names} option allows intruders to access + your module's global variables and may allow intruders to execute + arbitrary code on your machine. Only use this option on a secure, + closed network. + \end{notice} + + \versionchanged[\var{allow_dotted_names} was added to plug a security hole; + prior versions are insecure]{2.3.5, 2.4.1} + \end{methoddesc} \begin{methoddesc}{register_introspection_functions}{}

1 0

python/dist/src/Lib SimpleXMLRPCServer.py, 1.9, 1.10
by gvanrossum＠users.sourceforge.net Feb. 3, 2005

Feb. 3, 2005

Update of /cvsroot/python/python/dist/src/Lib In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv15460/Lib Modified Files: SimpleXMLRPCServer.py Log Message: Security fix PSF-2005-001 for SimpleXMLRPCServer.py. Index: SimpleXMLRPCServer.py =================================================================== RCS file: /cvsroot/python/python/dist/src/Lib/SimpleXMLRPCServer.py,v retrieving revision 1.9 retrieving revision 1.10 diff -u -d -r1.9 -r1.10 --- SimpleXMLRPCServer.py 3 Oct 2004 23:21:44 -0000 1.9 +++ SimpleXMLRPCServer.py 3 Feb 2005 15:01:24 -0000 1.10 @@ -106,14 +106,22 @@ import sys import os -def resolve_dotted_attribute(obj, attr): +def resolve_dotted_attribute(obj, attr, allow_dotted_names=True): """resolve_dotted_attribute(a, 'b.c.d') => a.b.c.d Resolves a dotted attribute name to an object. Raises an AttributeError if any attribute in the chain starts with a '_'. + + If the optional allow_dotted_names argument is false, dots are not + supported and this function operates similar to getattr(obj, attr). """ - for i in attr.split('.'): + if allow_dotted_names: + attrs = attr.split('.') + else: + attrs = [attr] + + for i in attrs: if i.startswith('_'): raise AttributeError( 'attempt to access private attribute "%s"' % i @@ -155,7 +163,7 @@ self.funcs = {} self.instance = None - def register_instance(self, instance): + def register_instance(self, instance, allow_dotted_names=False): """Registers an instance to respond to XML-RPC requests. Only one instance can be installed at a time. @@ -173,9 +181,23 @@ If a registered function matches a XML-RPC request, then it will be called instead of the registered instance. + + If the optional allow_dotted_names argument is true and the + instance does not have a _dispatch method, method names + containing dots are supported and resolved, as long as none of + the name segments start with an '_'. + + *** SECURITY WARNING: *** + + Enabling the allow_dotted_names options allows intruders + to access your module's global variables and may allow + intruders to execute arbitrary code on your machine. Only + use this option on a secure, closed network. + """ self.instance = instance + self.allow_dotted_names = allow_dotted_names def register_function(self, function, name = None): """Registers a function to respond to XML-RPC requests. @@ -294,7 +316,8 @@ try: method = resolve_dotted_attribute( self.instance, - method_name + method_name, + self.allow_dotted_names ) except AttributeError: pass @@ -373,7 +396,8 @@ try: func = resolve_dotted_attribute( self.instance, - method + method, + self.allow_dotted_names ) except AttributeError: pass

1 0

python/dist/src/Doc/lib libsimplexmlrpc.tex, 1.7, 1.7.2.1
by gvanrossum＠users.sourceforge.net Feb. 3, 2005

Feb. 3, 2005

Update of /cvsroot/python/python/dist/src/Doc/lib In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv15199/Doc/lib Modified Files: Tag: release24-maint libsimplexmlrpc.tex Log Message: Security fix PSF-2005-001 for SimpleXMLRPCServer.py. Index: libsimplexmlrpc.tex =================================================================== RCS file: /cvsroot/python/python/dist/src/Doc/lib/libsimplexmlrpc.tex,v retrieving revision 1.7 retrieving revision 1.7.2.1 diff -u -d -r1.7 -r1.7.2.1 --- libsimplexmlrpc.tex 8 Oct 2004 18:34:47 -0000 1.7 +++ libsimplexmlrpc.tex 3 Feb 2005 15:00:17 -0000 1.7.2.1 @@ -55,7 +55,8 @@ period character. \end{methoddesc} -\begin{methoddesc}[SimpleXMLRPCServer]{register_instance}{instance} +\begin{methoddesc}[SimpleXMLRPCServer]{register_instance}{instance\optional{, + allow_dotted_names}} Register an object which is used to expose method names which have not been registered using \method{register_function()}. If \var{instance} contains a \method{_dispatch()} method, it is called @@ -67,12 +68,26 @@ The return value from \method{_dispatch()} is returned to the client as the result. If \var{instance} does not have a \method{_dispatch()} method, it is - searched for an attribute matching the name of the requested method; + searched for an attribute matching the name of the requested method. + + If the optional \var{allow_dotted_names} argument is true and the + instance does not have a \method{_dispatch()} method, then if the requested method name contains periods, each component of the method name is searched for individually, with the effect that a simple hierarchical search is performed. The value found from this search is then called with the parameters from the request, and the return value is passed back to the client. + + \begin{notice}[warning] + Enabling the \var{allow_dotted_names} option allows intruders to access + your module's global variables and may allow intruders to execute + arbitrary code on your machine. Only use this option on a secure, + closed network. + \end{notice} + + \versionchanged[\var{allow_dotted_names} was added to plug a security hole; + prior versions are insecure]{2.3.5, 2.4.1} + \end{methoddesc} \begin{methoddesc}{register_introspection_functions}{}

1 0

python/dist/src/Lib SimpleXMLRPCServer.py, 1.9, 1.9.2.1
by gvanrossum＠users.sourceforge.net Feb. 3, 2005

Feb. 3, 2005

Update of /cvsroot/python/python/dist/src/Lib In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv15199/Lib Modified Files: Tag: release24-maint SimpleXMLRPCServer.py Log Message: Security fix PSF-2005-001 for SimpleXMLRPCServer.py. Index: SimpleXMLRPCServer.py =================================================================== RCS file: /cvsroot/python/python/dist/src/Lib/SimpleXMLRPCServer.py,v retrieving revision 1.9 retrieving revision 1.9.2.1 diff -u -d -r1.9 -r1.9.2.1 --- SimpleXMLRPCServer.py 3 Oct 2004 23:21:44 -0000 1.9 +++ SimpleXMLRPCServer.py 3 Feb 2005 15:00:18 -0000 1.9.2.1 @@ -106,14 +106,22 @@ import sys import os -def resolve_dotted_attribute(obj, attr): +def resolve_dotted_attribute(obj, attr, allow_dotted_names=True): """resolve_dotted_attribute(a, 'b.c.d') => a.b.c.d Resolves a dotted attribute name to an object. Raises an AttributeError if any attribute in the chain starts with a '_'. + + If the optional allow_dotted_names argument is false, dots are not + supported and this function operates similar to getattr(obj, attr). """ - for i in attr.split('.'): + if allow_dotted_names: + attrs = attr.split('.') + else: + attrs = [attr] + + for i in attrs: if i.startswith('_'): raise AttributeError( 'attempt to access private attribute "%s"' % i @@ -155,7 +163,7 @@ self.funcs = {} self.instance = None - def register_instance(self, instance): + def register_instance(self, instance, allow_dotted_names=False): """Registers an instance to respond to XML-RPC requests. Only one instance can be installed at a time. @@ -173,9 +181,23 @@ If a registered function matches a XML-RPC request, then it will be called instead of the registered instance. + + If the optional allow_dotted_names argument is true and the + instance does not have a _dispatch method, method names + containing dots are supported and resolved, as long as none of + the name segments start with an '_'. + + *** SECURITY WARNING: *** + + Enabling the allow_dotted_names options allows intruders + to access your module's global variables and may allow + intruders to execute arbitrary code on your machine. Only + use this option on a secure, closed network. + """ self.instance = instance + self.allow_dotted_names = allow_dotted_names def register_function(self, function, name = None): """Registers a function to respond to XML-RPC requests. @@ -294,7 +316,8 @@ try: method = resolve_dotted_attribute( self.instance, - method_name + method_name, + self.allow_dotted_names ) except AttributeError: pass @@ -373,7 +396,8 @@ try: func = resolve_dotted_attribute( self.instance, - method + method, + self.allow_dotted_names ) except AttributeError: pass

1 0

python/dist/src/Misc NEWS, 1.1193.2.17, 1.1193.2.18
by gvanrossum＠users.sourceforge.net Feb. 3, 2005

Feb. 3, 2005

Update of /cvsroot/python/python/dist/src/Misc In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv15199/Misc Modified Files: Tag: release24-maint NEWS Log Message: Security fix PSF-2005-001 for SimpleXMLRPCServer.py. Index: NEWS =================================================================== RCS file: /cvsroot/python/python/dist/src/Misc/NEWS,v retrieving revision 1.1193.2.17 retrieving revision 1.1193.2.18 diff -u -d -r1.1193.2.17 -r1.1193.2.18 --- NEWS 29 Jan 2005 13:33:27 -0000 1.1193.2.17 +++ NEWS 3 Feb 2005 15:00:18 -0000 1.1193.2.18 @@ -25,6 +25,10 @@ Library ------- +- Applied a security fix to SimpleXMLRPCserver (PSF-2005-001). This + disables recursive traversal through instance attributes, which can + be exploited in various ways. + - Bug #1110478: Revert os.environ.update to do putenv again. - Bug #1103844: fix distutils.install.dump_dirs() with negated options.

1 0

python/dist/src/Misc NEWS, 1.831.4.166, 1.831.4.167
by gvanrossum＠users.sourceforge.net Feb. 3, 2005

Feb. 3, 2005

Update of /cvsroot/python/python/dist/src/Misc In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv14953/Misc Modified Files: Tag: release23-maint NEWS Log Message: Security fix PSF-2005-001 for SimpleXMLRPCServer.py. Index: NEWS =================================================================== RCS file: /cvsroot/python/python/dist/src/Misc/NEWS,v retrieving revision 1.831.4.166 retrieving revision 1.831.4.167 diff -u -d -r1.831.4.166 -r1.831.4.167 --- NEWS 27 Jan 2005 18:55:01 -0000 1.831.4.166 +++ NEWS 3 Feb 2005 14:59:43 -0000 1.831.4.167 @@ -11,8 +11,17 @@ Core and builtins ----------------- + - Partially revert the fix for #1074011; don't try to fflush stdin anymore. +Library +------- + +- Applied a security fix to SimpleXMLRPCserver (PSF-2005-001). This + disables recursive traversal through instance attributes, which can + be exploited in various ways. + + What's New in Python 2.3.5rc1? ==============================

1 0