pool/python
SHA256
4
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix the patch

Browse Source 
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python?expand=0&rev=328
This commit is contained in:
Matej Cepl 2022-06-09 22:53:53 +00:00 committed by Git OBS Bridge
parent d38335e738
commit 9a59733bbe
1 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
CVE-2015-20107-mailcap-unsafe-filenames.patch
View File

@ -45,17 +45,17 @@
# Part 1: top-level interface. # Part 1: top-level interface.
def getcaps(): def getcaps():
@@ -16,6 +24,10 @@ def getcaps(): @@ -18,6 +26,10 @@ def getcaps():
where the viewing command is stored with the key "view".
""" """
+ if _find_unsafe(filename):
+ msg = "Refusing to use mailcap with filename %r. Use a safe temporary filename." % (filename,)
+ warnings.warn(msg, UnsafeMailcapInput)
+ return None, None
caps = {} caps = {}
for mailcap in listmailcapfiles(): for mailcap in listmailcapfiles():
+ if _find_unsafe(mailcap):
+ msg = "Refusing to use mailcap with filename %r. Use a safe temporary filename." % (mailcap,)
+ warnings.warn(msg, UnsafeMailcapInput)
+ return None, None
try: try:
fp = open(mailcap, 'r')
except IOError:
@@ -149,10 +161,13 @@ def findmatch(caps, MIMEtype, key='view' @@ -149,10 +161,13 @@ def findmatch(caps, MIMEtype, key='view'
for e in entries: for e in entries:
if 'test' in e: if 'test' in e: