René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Embedded null characters can lead to bugs or even security vulnerabilities","articleBody":"I just modified PyUnicode_AsUTF8() of the C API to raise an exception if a string contains an embedded null character to reduce the risk of security vulnerabilities. PyUnicode_AsUTF8() caller expects a string terminated by a null byte. If the UTF-8 encoded string contains embedded null byte, the caller is likely to truncate the string without knowing that there are more bytes after \"the first\" null byte.\r\n\r\nSee: https://owasp.org/www-community/attacks/Embedding_Null_Code\r\n\r\nIt's not only about security issue, it  can also just be seen as a bug: unwanted behavior.\r\n\r\nPrevious issues:\r\n\r\n* #111089\r\n* #106844\r\n* #106242 -- CVE-2023-41105\r\n* #103223\r\n* #84335\r\n* #73228\r\n* #66411\r\n* #65346\r\n* #57826\r\n\r\nDiscussions:\r\n\r\n* 2014: https://mail.python.org/archives/list/python-dev@python.org/thread/MZDL7FZZMRSW5MTIHLSA6ANNMCV7EEZN/\r\n\r\n---\r\n\r\nExample with Python 3.12:\r\n\r\n```py\r\nimport ctypes\r\n\r\nlibc = ctypes.cdll.LoadLibrary('libc.so.6')\r\nprintf = libc.printf\r\nPyUnicode_AsUTF8 = ctypes.pythonapi.PyUnicode_AsUTF8\r\nPyUnicode_AsUTF8.argtypes = (ctypes.py_object,)\r\nPyUnicode_AsUTF8.restype = ctypes.c_char_p\r\n\r\nmy_string = \"World\\0truncated string\"\r\nprintf(b\"Hello %s\\n\", PyUnicode_AsUTF8(my_string))\r\n```\r\n\r\nOutput:\r\n\r\n```\r\nHello World\r\n```\r\n\r\nThe ``truncated string`` part is silently ignored!\r\n\r\n---\r\n\r\nMultiple functions were modified in the past to prevent this problem. Examples:\r\n\r\n* _dbm.open(): check *filename*\r\n* _gdbm.open(): check *filename*\r\n* `PyBytes_AsStringAndSize(str, NULL)`\r\n* grp.getgrnam(): check *name*\r\n* pwd.getpwnam(): check *name*\r\n* _locale.strxfrm(): check argument\r\n* path_converter() of the os module: basically any filename and path\r\n* PyUnicode_AsWideCharString()\r\n* os.putenv()\r\n* _posixsubprocess.fork_exec(): executable_list\r\n* _struct.Struct: check *format*\r\n* _tkinter SetVar() and varname_converter()\r\n* _winapi.CreateProcess() getenvironment()\r\n* PyUnicode_EncodeLocale()\r\n* PyUnicode_EncodeFSDefault()\r\n* unicode_decode_locale()\r\n* PyUnicode_FSConverter()\r\n* PyUnicode_DecodeLocale()\r\n* PyUnicode_DecodeLocaleAndSize()\r\n* PyUnicode_FSDecoder()\r\n* PyUnicode_AsUTF8() -- recently modified\r\n* _Py_stat(): check *path*\r\n* getargs.c: 's', 'y' and 'z' formats\r\n\r\nThere are exceptions which accept embedded null bytes/characters:\r\n\r\n* socket: AF_UNIX socket name","author":{"url":"https://github.com/vstinner","@type":"Person","name":"vstinner"},"datePublished":"2023-11-02T17:10:38.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":10},"url":"https://github.com/111656/cpython/issues/111656"}