Message280120
| Author |
christian.heimes |
| Recipients |
Carl Ekerot, christian.heimes, loewis, serhiy.storchaka, xiang.zhang |
| Date |
2016年11月05日.18:17:49 |
| SpamBayes Score |
-1.0 |
| Marked as misclassified |
Yes |
| Message-id |
<1478369869.43.0.375278797825.issue28563@psf.upfronthosting.co.za> |
| In-reply-to |
| Content |
Argh, sorry. I meant to write "The gettext module might be vulnerable to more than f-string attacks.".
May I suggest that you have a look at my old patch? It uses an AST visitor to inspect the AST of a gettext plural expression. It allows only a limited set of AST types as well as limited amount of expressions. I consider it a superior solution and a fix for more generic attacks.
I haven't tested my patch with f-strings yet. It either refuses f-strings FormattedValue already or can be easily modified to reject it. |
|