Update of /cvsroot/mailman/mailman/scripts
In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv10038
Modified Files:
Tag: Release_2_1-maint
driver
Log Message:
Close a potential cross-site scripting hole, discovered by Florian Weimer.
Initial patch provided by Florian, modified by Barry.
Also, turn STEALTH_MODE on by default. Most sites won't change this value
from its default, so we might as well use the more secure option. Also, if
STEALTH_MODE is turned off, but the websafe() function can't be imported, turn
STEALTH_MODE back on.
Index: driver
===================================================================
RCS file: /cvsroot/mailman/mailman/scripts/driver,v
retrieving revision 2.6.2.1
retrieving revision 2.6.2.2
diff -u -d -r2.6.2.1 -r2.6.2.2
--- driver 20 Apr 2003 04:52:55 -0000 2.6.2.1
+++ driver 28 Dec 2004 00:38:22 -0000 2.6.2.2
@@ -1,6 +1,6 @@
# -*- python -*-
-# Copyright (C) 1998-2003 by the Free Software Foundation, Inc.
+# Copyright (C) 1998-2004 by the Free Software Foundation, Inc.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
@@ -28,7 +28,11 @@
# comfortable with. By setting STEALTH_MODE to 1, you disable the printing of
# this information to the web pages. This information is still, and always,
# printed in the error logs.
-STEALTH_MODE = 0
+STEALTH_MODE = 1
+
+# This will be set to the entity escaper.
+def websafe(s):
+ return s
@@ -53,12 +57,22 @@
def run_main():
+ global STEALTH_MODE, websafe
+
# These will ensure that even if something between now and the
# creation of the real logger below fails, we can still get
# *something* meaningful.
logger = None
try:
import paths
+ # When running in non-stealth mode, we need to escape entities,
+ # otherwise we're vulnerable to cross-site scripting attacks.
+ try:
+ if not STEALTH_MODE:
+ from Mailman.Utils import websafe
+ except:
+ STEALTH_MODE = 1
+ raise
# Map stderr to a logger, if possible.
from Mailman.Logging.StampedLogger import StampedLogger
logger = StampedLogger('error',
@@ -140,11 +154,13 @@
a description of what happened. Thanks!
<h4>Traceback:</h4><p><pre>'''
+ exc_info = sys.exc_info()
if traceback:
- traceback.print_exc(file=sys.stdout)
+ for line in traceback.format_exception(*exc_info):
+ print websafe(line),
else:
print '[failed to import module traceback]'
- print '[exc: %s, var: %s]' % sys.exc_info()[0:2]
+ print '[exc: %s, var: %s]' % [websafe(x) for x in exc_info[0:2]]
print '\n\n</pre></body>'
else:
print '''<p>Please inform the webmaster for this site of this
@@ -212,7 +228,9 @@
'''
if os:
for k, v in os.environ.items():
- print '<tr><td><tt>', k, '</tt></td><td>', v, '</td></tr>'
+ print '<tr><td><tt>', websafe(k), \
+ '</tt></td><td>', websafe(v), \
+ '</td></tr>'
print '</table>'
else:
print '<p><hr>[failed to import module os]'
_______________________________________________
Mailman-checkins mailing list
[email protected]
Unsubscribe:
http://mail.python.org/mailman/options/mailman-checkins/archive%40jab.org
