diff options
| author | Serhiy Storchaka <storchaka@gmail.com> | 2017-06-23 16:39:27 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2017-06-23 16:39:27 (GMT) |
| commit | d174d24a5d37d1516b885dc7c82f71ecd5930700 (patch) | |
| tree | d9fd67e5993b32d8b80c58099dd4a6aa0672722b /Lib/subprocess.py | |
| parent | d352d689775699c289e011e8cec52c23c600b7fa (diff) | |
| download | cpython-d174d24a5d37d1516b885dc7c82f71ecd5930700.zip cpython-d174d24a5d37d1516b885dc7c82f71ecd5930700.tar.gz cpython-d174d24a5d37d1516b885dc7c82f71ecd5930700.tar.bz2 | |
bpo-30730: Prevent environment variables injection in subprocess on Windows. (#2325)
Prevent passing other invalid environment variables and command arguments.
Diffstat (limited to 'Lib/subprocess.py')
| -rw-r--r-- | Lib/subprocess.py | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/Lib/subprocess.py b/Lib/subprocess.py index 3241758..99bca47 100644 --- a/Lib/subprocess.py +++ b/Lib/subprocess.py @@ -1238,8 +1238,12 @@ class Popen(object): # and pass it to fork_exec() if env is not None: - env_list = [os.fsencode(k) + b'=' + os.fsencode(v) - for k, v in env.items()] + env_list = [] + for k, v in env.items(): + k = os.fsencode(k) + if b'=' in k: + raise ValueError("illegal environment variable name") + env_list.append(k + b'=' + os.fsencode(v)) else: env_list = None # Use execv instead of execve. executable = os.fsencode(executable) |