[Python-checkins] gh-87604: Avoid publishing list of active per-interpreter audit hooks via the gc module (GH-99373)
miss-islington
webhook-mailer at python.org
Tue Nov 15 15:52:58 EST 2022
https://github.com/python/cpython/commit/e470803295164f0c160ccf9d0c4b0b5beab59ce0
commit: e470803295164f0c160ccf9d0c4b0b5beab59ce0
branch: 3.10
author: Miss Islington (bot) <31488909+miss-islington at users.noreply.github.com>
committer: miss-islington <31488909+miss-islington at users.noreply.github.com>
date: 2022-11-15T12:52:14-08:00
summary:
gh-87604: Avoid publishing list of active per-interpreter audit hooks via the gc module (GH-99373)
(cherry picked from commit 4e4b13e8f6211abbc0d53056da11357756daa314)
Co-authored-by: Steve Dower <steve.dower at python.org>
files:
A Misc/NEWS.d/next/Security/2022-11-11-12-50-28.gh-issue-87604.OtwH5L.rst
M Lib/test/audit-tests.py
M Lib/test/test_audit.py
M Python/sysmodule.c
diff --git a/Lib/test/audit-tests.py b/Lib/test/audit-tests.py
index b781b9940465..481aedd6b4b2 100644
--- a/Lib/test/audit-tests.py
+++ b/Lib/test/audit-tests.py
@@ -429,6 +429,17 @@ def hook(event, args):
syslog.closelog()
+def test_not_in_gc():
+ import gc
+
+ hook = lambda *a: None
+ sys.addaudithook(hook)
+
+ for o in gc.get_objects():
+ if isinstance(o, list):
+ assert hook not in o
+
+
if __name__ == "__main__":
from test.support import suppress_msvcrt_asserts
diff --git a/Lib/test/test_audit.py b/Lib/test/test_audit.py
index cea452ddce51..10a61c60b57e 100644
--- a/Lib/test/test_audit.py
+++ b/Lib/test/test_audit.py
@@ -195,6 +195,11 @@ def test_syslog(self):
('syslog.closelog', '', '')]
)
+ def test_not_in_gc(self):
+ returncode, _, stderr = self.run_python("test_not_in_gc")
+ if returncode:
+ self.fail(stderr)
+
if __name__ == "__main__":
unittest.main()
diff --git a/Misc/NEWS.d/next/Security/2022-11-11-12-50-28.gh-issue-87604.OtwH5L.rst b/Misc/NEWS.d/next/Security/2022-11-11-12-50-28.gh-issue-87604.OtwH5L.rst
new file mode 100644
index 000000000000..c931409b8171
--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2022-11-11-12-50-28.gh-issue-87604.OtwH5L.rst
@@ -0,0 +1,2 @@
+Avoid publishing list of active per-interpreter audit hooks via the
+:mod:`gc` module
diff --git a/Python/sysmodule.c b/Python/sysmodule.c
index 1d5a06a6b478..2b5c9d3ebbe8 100644
--- a/Python/sysmodule.c
+++ b/Python/sysmodule.c
@@ -462,6 +462,8 @@ sys_addaudithook_impl(PyObject *module, PyObject *hook)
if (interp->audit_hooks == NULL) {
return NULL;
}
+ /* Avoid having our list of hooks show up in the GC module */
+ PyObject_GC_UnTrack(interp->audit_hooks);
}
if (PyList_Append(interp->audit_hooks, hook) < 0) {
More information about the Python-checkins
mailing list