[New-bugs-announce] [issue38985] `compile` returns the first line of file on termination

Koh report at bugs.python.org
Fri Dec 6 04:29:05 EST 2019

New submission from Koh <kohyouliang at gmail.com>:

By specifying a filename in the compile function and then improperly terminating it, we are able to return the first line of any file.

>> compile('yield', '/etc/passwd', 'exec')
File "/etc/passwd", line 1
SyntaxError: 'yield' outside function

Is this intended behavior? I have been able to use it to escape sandboxes.

messages: 357906
nosy: iso
priority: normal
severity: normal
status: open
title: `compile` returns the first line of file on termination
type: security
versions: Python 2.7, Python 3.5, Python 3.6, Python 3.7, Python 3.8, Python 3.9

Python tracker <report at bugs.python.org>

More information about the New-bugs-announce mailing list