Message297468
| Author |
steve.dower |
| Recipients |
benjamin.peterson, georg.brandl, larry, ned.deily, paul.moore, serhiy.storchaka, steve.dower, tim.golden, zach.ware |
| Date |
2017年07月01日.04:37:07 |
| SpamBayes Score |
-1.0 |
| Marked as misclassified |
Yes |
| Message-id |
<1498883827.43.0.157852676739.issue30730@psf.upfronthosting.co.za> |
| In-reply-to |
| Content |
It's certainly exploitable for remote code execution if user data allows embedded nulls (can you URL encode %00?). The fixes look fine and shouldn't cause any new issues, though I thought that fsencode() already rejected embedded nulls - maybe I'm thinking of the argument converter though, which is not invoked here. |
|