[Zope-Checkins] CVS: Zope/lib/python/Products/PageTemplates -
Expressions.py:1.36.6.10 ZRPythonExpr.py:1.10.6.1
Tres Seaver
tseaver at zope.com
Thu Jan 8 15:12:39 EST 2004
Update of /cvs-repository/Zope/lib/python/Products/PageTemplates
In directory cvs.zope.org:/tmp/cvs-serv29583/lib/python/Products/PageTemplates
Modified Files:
Tag: Zope-2_6-branch
Expressions.py ZRPythonExpr.py
Log Message:
- Enforce new restrictions on untrusted code, identified during
the December 2003 security audit. These issues affect sites
that allow untrusted users to write Python Scripts, Page Templates,
and DTML:
o Iteration over sequences could in some cases fail to check access
to an object obtained from the sequence. Subsequent checks (such
as for attributes access) of such an object would still be
performed, but it should not have been possible to obtain the
object in the first place.
o List and dictionary instance methods such as the get method of
dictionary objects were not security aware and could return an
object without checking access to that object. Subsequent checks
(such as for attributes access) of such an object would still be
performed, but it should not have been possible to obtain the
object in the first place.
o Use of 'import as. in Python scripts could potentially rebind
names in ways that could be used to avoid appropriate security
checks.
o A number of newer built-ins (min, max, enumerate, iter, sum)
were either unavailable in untrusted code or did not perform
adequate security checking.
o Unpacking via function calls, variable assignment, exception
variables and other contexts did not perform adequate security
checks, potentially allowing access to objects that should have
been protected.
o DTMLMethods with proxy rights could incorrectly transfer those
rights via acquisition when traversing to a parent object.
=== Zope/lib/python/Products/PageTemplates/Expressions.py 1.36.6.9 => 1.36.6.10 ===
--- Zope/lib/python/Products/PageTemplates/Expressions.py:1.36.6.9 Thu Sep 26 17:35:17 2002
+++ Zope/lib/python/Products/PageTemplates/Expressions.py Thu Jan 8 15:12:08 2004
@@ -54,12 +54,7 @@
from AccessControl import Unauthorized
except ImportError:
Unauthorized = "Unauthorized"
- if hasattr(AccessControl, 'full_read_guard'):
- from ZRPythonExpr import PythonExpr, _SecureModuleImporter, \
- call_with_ns
- else:
- from ZPythonExpr import PythonExpr, _SecureModuleImporter, \
- call_with_ns
+ from ZRPythonExpr import PythonExpr, _SecureModuleImporter, call_with_ns
else:
from PythonExpr import getSecurityManager, PythonExpr
guarded_getattr = getattr
@@ -313,7 +308,7 @@
# Skip directly to item access
o = object[name]
# Check access to the item.
- if not validate(object, object, name, o):
+ if not validate(object, object, None, o):
raise Unauthorized, name
object = o
continue
@@ -368,7 +363,7 @@
raise
else:
# Check access to the item.
- if not validate(object, object, name, o):
+ if not validate(object, object, None, o):
raise Unauthorized, name
object = o
=== Zope/lib/python/Products/PageTemplates/ZRPythonExpr.py 1.10 => 1.10.6.1 ===
--- Zope/lib/python/Products/PageTemplates/ZRPythonExpr.py:1.10 Wed Aug 14 18:17:24 2002
+++ Zope/lib/python/Products/PageTemplates/ZRPythonExpr.py Thu Jan 8 15:12:08 2004
@@ -18,19 +18,18 @@
__version__='$Revision$'[11:-2]
-from AccessControl import full_read_guard, full_write_guard, \
- safe_builtins, getSecurityManager
-from AccessControl.ZopeGuards import guarded_getattr, guarded_getitem
+from AccessControl import safe_builtins
+from AccessControl.ZopeGuards import guarded_getattr, get_safe_globals
from RestrictedPython import compile_restricted_eval
from TALES import CompilerError
from PythonExpr import PythonExpr
class PythonExpr(PythonExpr):
- _globals = {'__debug__': __debug__,
- '__builtins__': safe_builtins,
- '_getattr_': guarded_getattr,
- '_getitem_': guarded_getitem,}
+ _globals = get_safe_globals()
+ _globals['_getattr_'] = guarded_getattr
+ _globals['__debug__' ] = __debug__
+
def __init__(self, name, expr, engine):
self.expr = expr = expr.strip().replace('\n', ' ')
code, err, warn, use = compile_restricted_eval(expr, str(self))
More information about the Zope-Checkins
mailing list