|
| 1 | +From 241312a0fb234989db874a723dbb2f05907796d3 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Kanishk-Bansal <kbkanishk975@gmail.com> |
| 3 | +Date: Thu, 2 Jan 2025 14:40:27 +0000 |
| 4 | +Subject: [PATCH] Fix CVE-2024-56326 |
| 5 | + |
| 6 | +--- |
| 7 | + src/jinja2/sandbox.py | 75 +++++++++++++++++++++---------------------- |
| 8 | + 1 file changed, 37 insertions(+), 38 deletions(-) |
| 9 | + |
| 10 | +diff --git a/src/jinja2/sandbox.py b/src/jinja2/sandbox.py |
| 11 | +index 06d7414..c3f4a33 100644 |
| 12 | +--- a/src/jinja2/sandbox.py |
| 13 | ++++ b/src/jinja2/sandbox.py |
| 14 | +@@ -7,6 +7,7 @@ import typing as t |
| 15 | + from _string import formatter_field_name_split # type: ignore |
| 16 | + from collections import abc |
| 17 | + from collections import deque |
| 18 | ++from functools import update_wrapper |
| 19 | + from string import Formatter |
| 20 | + |
| 21 | + from markupsafe import EscapeFormatter |
| 22 | +@@ -80,20 +81,6 @@ _mutable_spec: t.Tuple[t.Tuple[t.Type, t.FrozenSet[str]], ...] = ( |
| 23 | + ) |
| 24 | + |
| 25 | + |
| 26 | +-def inspect_format_method(callable: t.Callable) -> t.Optional[str]: |
| 27 | +- if not isinstance( |
| 28 | +- callable, (types.MethodType, types.BuiltinMethodType) |
| 29 | +- ) or callable.__name__ not in ("format", "format_map"): |
| 30 | +- return None |
| 31 | +- |
| 32 | +- obj = callable.__self__ |
| 33 | +- |
| 34 | +- if isinstance(obj, str): |
| 35 | +- return obj |
| 36 | +- |
| 37 | +- return None |
| 38 | +- |
| 39 | +- |
| 40 | + def safe_range(*args: int) -> range: |
| 41 | + """A range that can't generate ranges with a length of more than |
| 42 | + MAX_RANGE items. |
| 43 | +@@ -313,6 +300,9 @@ class SandboxedEnvironment(Environment): |
| 44 | + except AttributeError: |
| 45 | + pass |
| 46 | + else: |
| 47 | ++ fmt = self.wrap_str_format(value) |
| 48 | ++ if fmt is not None: |
| 49 | ++ return fmt |
| 50 | + if self.is_safe_attribute(obj, argument, value): |
| 51 | + return value |
| 52 | + return self.unsafe_undefined(obj, argument) |
| 53 | +@@ -330,6 +320,9 @@ class SandboxedEnvironment(Environment): |
| 54 | + except (TypeError, LookupError): |
| 55 | + pass |
| 56 | + else: |
| 57 | ++ fmt = self.wrap_str_format(value) |
| 58 | ++ if fmt is not None: |
| 59 | ++ return fmt |
| 60 | + if self.is_safe_attribute(obj, attribute, value): |
| 61 | + return value |
| 62 | + return self.unsafe_undefined(obj, attribute) |
| 63 | +@@ -345,34 +338,43 @@ class SandboxedEnvironment(Environment): |
| 64 | + exc=SecurityError, |
| 65 | + ) |
| 66 | + |
| 67 | +- def format_string( |
| 68 | +- self, |
| 69 | +- s: str, |
| 70 | +- args: t.Tuple[t.Any, ...], |
| 71 | +- kwargs: t.Dict[str, t.Any], |
| 72 | +- format_func: t.Optional[t.Callable] = None, |
| 73 | +- ) -> str: |
| 74 | +- """If a format call is detected, then this is routed through this |
| 75 | +- method so that our safety sandbox can be used for it. |
| 76 | ++ def wrap_str_format(self, value: t.Any) -> t.Optional[t.Callable[..., str]]: |
| 77 | ++ """If the given value is a ``str.format`` or ``str.format_map`` method, |
| 78 | ++ return a new function than handles sandboxing. This is done at access |
| 79 | ++ rather than in :meth:`call`, so that calls made without ``call`` are |
| 80 | ++ also sandboxed. |
| 81 | + """ |
| 82 | ++ if not isinstance( |
| 83 | ++ value, (types.MethodType, types.BuiltinMethodType) |
| 84 | ++ ) or value.__name__ not in ("format", "format_map"): |
| 85 | ++ return None |
| 86 | ++ f_self: t.Any = value.__self__ |
| 87 | ++ if not isinstance(f_self, str): |
| 88 | ++ return None |
| 89 | ++ str_type: t.Type[str] = type(f_self) |
| 90 | ++ is_format_map = value.__name__ == "format_map" |
| 91 | + formatter: SandboxedFormatter |
| 92 | +- if isinstance(s, Markup): |
| 93 | +- formatter = SandboxedEscapeFormatter(self, escape=s.escape) |
| 94 | ++ |
| 95 | ++ if isinstance(f_self, Markup): |
| 96 | ++ formatter = SandboxedEscapeFormatter(self, escape=f_self.escape) |
| 97 | + else: |
| 98 | + formatter = SandboxedFormatter(self) |
| 99 | + |
| 100 | +- if format_func is not None and format_func.__name__ == "format_map": |
| 101 | +- if len(args) != 1 or kwargs: |
| 102 | +- raise TypeError( |
| 103 | +- "format_map() takes exactly one argument" |
| 104 | +- f" {len(args) + (kwargs is not None)} given" |
| 105 | +- ) |
| 106 | ++ vformat = formatter.vformat |
| 107 | ++ def wrapper(*args: t.Any, **kwargs: t.Any) -> str: |
| 108 | ++ if is_format_map: |
| 109 | ++ if kwargs: |
| 110 | ++ raise TypeError("format_map() takes no keyword arguments") |
| 111 | ++ if len(args) != 1: |
| 112 | ++ raise TypeError( |
| 113 | ++ f"format_map() takes exactly one argument ({len(args)} given)" |
| 114 | ++ ) |
| 115 | ++ kwargs = args[0] |
| 116 | ++ args = () |
| 117 | + |
| 118 | +- kwargs = args[0] |
| 119 | +- args = () |
| 120 | ++ return str_type(vformat(f_self, args, kwargs)) |
| 121 | + |
| 122 | +- rv = formatter.vformat(s, args, kwargs) |
| 123 | +- return type(s)(rv) |
| 124 | ++ return update_wrapper(wrapper, value) |
| 125 | + |
| 126 | + def call( |
| 127 | + __self, # noqa: B902 |
| 128 | +@@ -382,9 +384,6 @@ class SandboxedEnvironment(Environment): |
| 129 | + **kwargs: t.Any, |
| 130 | + ) -> t.Any: |
| 131 | + """Call an object from sandboxed code.""" |
| 132 | +- fmt = inspect_format_method(__obj) |
| 133 | +- if fmt is not None: |
| 134 | +- return __self.format_string(fmt, args, kwargs, __obj) |
| 135 | + |
| 136 | + # the double prefixes are to avoid double keyword argument |
| 137 | + # errors when proxying the call. |
| 138 | +-- |
| 139 | +2.45.2 |
| 140 | + |
0 commit comments