Message280119
| Author |
Carl Ekerot |
| Recipients |
Carl Ekerot, christian.heimes, loewis, serhiy.storchaka, xiang.zhang |
| Date |
2016年11月05日.18:00:31 |
| SpamBayes Score |
-1.0 |
| Marked as misclassified |
Yes |
| Message-id |
<1478368831.96.0.692466556365.issue28563@psf.upfronthosting.co.za> |
| In-reply-to |
| Content |
> The gettext module might be vulnerable to f-string attacks
It is. See the example in the first comment:
gettext.c2py('f"{os.system(\'sh\')}"')(0)
This vulnerability seems to be solved in Xiang's patch. The DoS aspect is interesting though, since there's no constraints against malicious use of the power-operator, say "9**9**9**..**9". This too would be solved by implementing a parser with only simple arithmetics. |
|