platform.architecture does not correctly escape argument to /usr/bin/file

[DavidBenjamin]

BPO	16112
Nosy	@malemburg, @jcea, @pitrou, @vstinner, @tiran
Files	fix-platform-architecture.patch: Use subprocess instead of os.popen to run file platform.patch

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/jcea'
closed_at = <Date 2016-09-09.07:34:22.855>
created_at = <Date 2012-10-02.19:15:16.864>
labels = ['type-security', 'library']
title = 'platform.architecture does not correctly escape argument to /usr/bin/file'
updated_at = <Date 2016-09-09.07:38:04.571>
user = 'https://bugs.python.org/DavidBenjamin'

bugs.python.org fields:

activity = <Date 2016-09-09.07:38:04.571>
actor = 'vstinner'
assignee = 'jcea'
closed = True
closed_date = <Date 2016-09-09.07:34:22.855>
closer = 'vstinner'
components = ['Library (Lib)']
creation = <Date 2012-10-02.19:15:16.864>
creator = 'David.Benjamin'
dependencies = []
files = ['27391', '27427']
hgrepos = []
issue_num = 16112
keywords = ['patch']
message_count = 36.0
messages = ['171825', '171934', '171936', '171937', '171939', '171940', '171942', '171944', '171957', '171982', '171999', '172017', '172021', '172022', '172023', '172024', '172026', '172043', '172044', '172045', '172046', '172047', '172050', '172052', '172055', '172057', '172075', '172085', '172172', '172533', '173265', '275212', '275254', '275278', '275280', '275281']
nosy_count = 8.0
nosy_names = ['lemburg', 'jcea', 'pitrou', 'vstinner', 'christian.heimes', 'Arfrever', 'python-dev', 'David.Benjamin']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = 'needs patch'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue16112'
versions = ['Python 2.7', 'Python 3.2', 'Python 3.3', 'Python 3.4']

[DavidBenjamin]

The implementation of platform.architecture shells out to the file command. It tries to escape quotes by replacing " with \", but that's not sufficient.

$ python3.2 -c 'import platform; platform.architecture("foo\\\"; echo Hi there > /tmp/Z; echo \\\"")' && cat /tmp/Z
Hi there

Here's a patch to make it use subprocess instead. I haven't tested it thoroughly building everything from trunk and running tests, but I verified it works by replacing the platform.py in my system Python install.

[jcea]

This is security risk, but I can't think about any "platform.architecture()" use that would use a untrusted parameter. Nevertheless "os.popen()" has been deprecated for ages. I take care of this.

[python-dev]

New changeset c73b90b6dadd by Jesus Cea in branch '2.7':
Closes bpo-16112: platform.architecture does not correctly escape argument to /usr/bin/file
http://hg.python.org/cpython/rev/c73b90b6dadd

New changeset 6c830b657900 by Jesus Cea in branch '3.2':
Closes bpo-16112: platform.architecture does not correctly escape argument to /usr/bin/file
http://hg.python.org/cpython/rev/6c830b657900

New changeset 3112bf7e0ecb by Jesus Cea in branch '3.3':
MERGE: Closes bpo-16112: platform.architecture does not correctly escape argument to /usr/bin/file
http://hg.python.org/cpython/rev/3112bf7e0ecb

New changeset cd026866b333 by Jesus Cea in branch 'default':
MERGE: Closes bpo-16112: platform.architecture does not correctly escape argument to /usr/bin/file
http://hg.python.org/cpython/rev/cd026866b333

[jcea]

I have a bootstrap problem with python 2.7. Backout that patch, for now.

[python-dev]

New changeset d6d908dc11f2 by Jesus Cea in branch '2.7':
Closes bpo-16112: platform.architecture does not correctly escape argument to /usr/bin/file. Solve a 2.7 bootstrap issue
http://hg.python.org/cpython/rev/d6d908dc11f2

[jcea]

Thanks for bringing this up and for your patch.

[vstinner]

I did a similar commit two years ago, but I reverted it because I failed to find a solution for the bootstrap issue.

changeset: 60673:7c90ac194e40
branch: legacy-trunk
parent: 60664:d7d5c76545fb
user: Victor Stinner <victor.stinner@haypocalc.com>
date: Sun Apr 18 09:07:49 2010 +0000
files: Lib/platform.py
description:
platform: use subprocess.Popen() instead of os.popen() in _syscmd_file()

• Popen() avoids ugly shell escape: target.replace('"', '\\"')
• Use proc.communicate() instead of f.stdout.read()
• Get output from stdout by splitting with ": " instead of splitting by spaces
  to support filename with spaces