From 98b40f8dd96cf4f2997e7dc935d2fe7b9efd24ab Mon Sep 17 00:00:00 2001 From: changtao Date: Sun, 15 Dec 2024 07:14:04 +0800 Subject: [PATCH] fix CVE-2024-56326 --- Jinja2-2.11.2/src/jinja2/sandbox.py | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/Jinja2-2.11.2/src/jinja2/sandbox.py b/Jinja2-2.11.2/src/jinja2/sandbox.py index 3f78075..4ddd50a 100644 --- a/Jinja2-2.11.2/src/jinja2/sandbox.py +++ b/Jinja2-2.11.2/src/jinja2/sandbox.py @@ -423,25 +423,24 @@ class SandboxedEnvironment(Environment): exc=SecurityError, ) - def wrap_str_format(self, value: t.Any) -> t.Optional[t.Callable[..., str]]: + def wrap_str_format(self, value): """If the given value is a ``str.format`` or ``str.format_map`` method, - return a new function than handles sandboxing. This is done at access + return a new function that handles sandboxing. This is done at access rather than in :meth:`call`, so that calls made without ``call`` are also sandboxed. """ - if not isinstance( - value, (types.MethodType, types.BuiltinMethodType) - ) or value.__name__ not in ("format", "format_map"): + if not isinstance(value, (types.MethodType, types.BuiltinMethodType)) or value.__name__ not in ("format", "format_map"): return None - f_self: t.Any = value.__self__ + f_self = value.__self__ if not isinstance(f_self, str): return None - str_type: t.Type[str] = type(f_self) + str_type = type(f_self) is_format_map = value.__name__ == "format_map" - formatter: SandboxedFormatter + formatter = None + if isinstance(f_self, Markup): formatter = SandboxedEscapeFormatter(self, escape=f_self.escape) else: @@ -449,20 +448,20 @@ class SandboxedEnvironment(Environment): vformat = formatter.vformat - def wrapper(*args: t.Any, **kwargs: t.Any) -> str: + def wrapper(*args, **kwargs): if is_format_map: if kwargs: raise TypeError("format_map() takes no keyword arguments") if len(args) != 1: raise TypeError( - f"format_map() takes exactly one argument ({len(args)} given)" + "format_map() takes exactly one argument ({0} given)".format(len(args)) ) kwargs = args[0] args = () - return str_type(vformat(f_self, args, kwargs)) + return str_type(vformat(f_self, args, kwargs)) return update_wrapper(wrapper, value) -- 2.43.0