Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow only safe syntax in c.expand_path_expression #3260

Closed
edreamleo opened this issue Apr 7, 2023 · 2 comments
Closed

Allow only safe syntax in c.expand_path_expression #3260

edreamleo opened this issue Apr 7, 2023 · 2 comments
Assignees
@edreamleo
Labels
Code Re Leo's code Enhancement
Milestone
6.7.3

Comments

@edreamleo
Copy link
Member

edreamleo commented Apr 7, 2023 •
edited

See PR #3264.

Path expressions are desirable, but they must be made completely safe. Leo' present path expressions (c.expand_path_expression) are serious security violations that virus scanners will never find.

Aha: c.expand_path_expression need only use Python's existing os.path capabilities. os.path.expandvars does more than Leo's legacy path expression!
Bye-bye {{ and }}!
@edreamleo edreamleo added Enhancement Code Re Leo's code labels Apr 7, 2023
@edreamleo edreamleo added this to the 6.7.3 milestone Apr 7, 2023
@edreamleo edreamleo self-assigned this Apr 7, 2023
@boltex
Copy link
Contributor

boltex commented Apr 8, 2023

it's already implemented in leojs.

can you elaborate as to why it would be a security concern?

@edreamleo edreamleo changed the title Don't use c.expand_path_expression Allow only safe syntax in c.expand_path_expression Apr 8, 2023
@edreamleo edreamleo mentioned this issue Apr 8, 2023
Merged
3 tasks
@edreamleo
Copy link
Member Author

Closed via PR #3264.

This was referenced Apr 9, 2023
Closed
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@edreamleo edreamleo

Labels
Code Re Leo's code Enhancement
Projects
None yet
Milestone
6.7.3
Development

No branches or pull requests
2 participants
@edreamleo @boltex