diff options
| author | Miss Skeleton (bot) <31488909+miss-islington@users.noreply.github.com> | 2020-11-02 21:34:46 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-11-02 21:34:46 (GMT) |
| commit | e277cb76989958fdbc092bf0b2cb55c43e86610a (patch) | |
| tree | 8d698547371d7b995e7200ff469fb8411891fd2c /Misc | |
| parent | 723e21a8e79815ae77474d1f21b9847b9c9bdbeb (diff) | |
| download | cpython-e277cb76989958fdbc092bf0b2cb55c43e86610a.zip cpython-e277cb76989958fdbc092bf0b2cb55c43e86610a.tar.gz cpython-e277cb76989958fdbc092bf0b2cb55c43e86610a.tar.bz2 | |
bpo-42103: Improve validation of Plist files. (GH-22882)
* Prevent some possible DoS attacks via providing invalid Plist files
with extremely large number of objects or collection sizes.
* Raise InvalidFileException for too large bytes and string size instead of returning garbage.
* Raise InvalidFileException instead of ValueError for specific invalid datetime (NaN).
* Raise InvalidFileException instead of TypeError for non-hashable dict keys.
* Add more tests for invalid Plist files.
(cherry picked from commit 34637a0ce21e7261b952fbd9d006474cc29b681f)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Diffstat (limited to 'Misc')
| -rw-r--r-- | Misc/NEWS.d/next/Library/2020-10-23-19-20-14.bpo-42103.C5obK2.rst | 3 | ||||
| -rw-r--r-- | Misc/NEWS.d/next/Security/2020-10-23-19-19-30.bpo-42103.cILT66.rst | 2 |
2 files changed, 5 insertions, 0 deletions
diff --git a/Misc/NEWS.d/next/Library/2020-10-23-19-20-14.bpo-42103.C5obK2.rst b/Misc/NEWS.d/next/Library/2020-10-23-19-20-14.bpo-42103.C5obK2.rst new file mode 100644 index 0000000..4eb694c --- /dev/null +++ b/Misc/NEWS.d/next/Library/2020-10-23-19-20-14.bpo-42103.C5obK2.rst @@ -0,0 +1,3 @@ +:exc:`~plistlib.InvalidFileException` and :exc:`RecursionError` are now +the only errors caused by loading malformed binary Plist file (previously +ValueError and TypeError could be raised in some specific cases). diff --git a/Misc/NEWS.d/next/Security/2020-10-23-19-19-30.bpo-42103.cILT66.rst b/Misc/NEWS.d/next/Security/2020-10-23-19-19-30.bpo-42103.cILT66.rst new file mode 100644 index 0000000..15d7b65 --- /dev/null +++ b/Misc/NEWS.d/next/Security/2020-10-23-19-19-30.bpo-42103.cILT66.rst @@ -0,0 +1,2 @@ +Prevented potential DoS attack via CPU and RAM exhaustion when processing +malformed Apple Property List files in binary format. |