From 46c7a6566bca2e974a89c90c35ed1c498d9d3b02 Mon Sep 17 00:00:00 2001 From: Vinay Sajip Date: Thu, 6 Jan 2022 22:35:08 +0000 Subject: =?UTF-8?q?bpo-46251:=20Add=20'Security=20Considerations'=20sectio?= =?UTF-8?q?n=20to=20logging=20configura=E2=80=A6=20(GH-30411)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- Doc/library/logging.config.rst | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/Doc/library/logging.config.rst b/Doc/library/logging.config.rst index 5a3e686..a1b8dc7 100644 --- a/Doc/library/logging.config.rst +++ b/Doc/library/logging.config.rst @@ -191,6 +191,20 @@ in :mod:`logging` itself) and defining handlers which are declared either in :func:`listen`. +Security considerations +^^^^^^^^^^^^^^^^^^^^^^^ + +The logging configuration functionality tries to offer convenience, and in part this +is done by offering the ability to convert text in configuration files into Python +objects used in logging configuration - for example, as described in +:ref:`logging-config-dict-userdef`. However, these same mechanisms (importing +callables from user-defined modules and calling them with parameters from the +configuration) could be used to invoke any code you like, and for this reason you +should treat configuration files from untrusted sources with *extreme caution* and +satisfy yourself that nothing bad can happen if you load them, before actually loading +them. + + .. _logging-config-dictschema: Configuration dictionary schema -- cgit v0.12