74 lines
2.7 KiB
Diff
74 lines
2.7 KiB
Diff
From 98b40f8dd96cf4f2997e7dc935d2fe7b9efd24ab Mon Sep 17 00:00:00 2001
|
|
From: changtao <changtao@kylinos.cn>
|
|
Date: Sun, 15 Dec 2024 07:14:04 +0800
|
|
Subject: [PATCH] fix CVE-2024-56326
|
|
|
|
---
|
|
Jinja2-2.11.2/src/jinja2/sandbox.py | 21 ++++++++++-----------
|
|
1 file changed, 10 insertions(+), 11 deletions(-)
|
|
|
|
diff --git a/Jinja2-2.11.2/src/jinja2/sandbox.py b/Jinja2-2.11.2/src/jinja2/sandbox.py
|
|
index 3f78075..4ddd50a 100644
|
|
--- a/Jinja2-2.11.2/src/jinja2/sandbox.py
|
|
+++ b/Jinja2-2.11.2/src/jinja2/sandbox.py
|
|
@@ -423,25 +423,24 @@ class SandboxedEnvironment(Environment):
|
|
exc=SecurityError,
|
|
)
|
|
|
|
- def wrap_str_format(self, value: t.Any) -> t.Optional[t.Callable[..., str]]:
|
|
+ def wrap_str_format(self, value):
|
|
"""If the given value is a ``str.format`` or ``str.format_map`` method,
|
|
- return a new function than handles sandboxing. This is done at access
|
|
+ return a new function that handles sandboxing. This is done at access
|
|
rather than in :meth:`call`, so that calls made without ``call`` are
|
|
also sandboxed.
|
|
"""
|
|
- if not isinstance(
|
|
- value, (types.MethodType, types.BuiltinMethodType)
|
|
- ) or value.__name__ not in ("format", "format_map"):
|
|
+ if not isinstance(value, (types.MethodType, types.BuiltinMethodType)) or value.__name__ not in ("format", "format_map"):
|
|
return None
|
|
|
|
- f_self: t.Any = value.__self__
|
|
+ f_self = value.__self__
|
|
|
|
if not isinstance(f_self, str):
|
|
return None
|
|
|
|
- str_type: t.Type[str] = type(f_self)
|
|
+ str_type = type(f_self)
|
|
is_format_map = value.__name__ == "format_map"
|
|
- formatter: SandboxedFormatter
|
|
+ formatter = None
|
|
+
|
|
if isinstance(f_self, Markup):
|
|
formatter = SandboxedEscapeFormatter(self, escape=f_self.escape)
|
|
else:
|
|
@@ -449,20 +448,20 @@ class SandboxedEnvironment(Environment):
|
|
|
|
vformat = formatter.vformat
|
|
|
|
- def wrapper(*args: t.Any, **kwargs: t.Any) -> str:
|
|
+ def wrapper(*args, **kwargs):
|
|
if is_format_map:
|
|
if kwargs:
|
|
raise TypeError("format_map() takes no keyword arguments")
|
|
|
|
if len(args) != 1:
|
|
raise TypeError(
|
|
- f"format_map() takes exactly one argument ({len(args)} given)"
|
|
+ "format_map() takes exactly one argument ({0} given)".format(len(args))
|
|
)
|
|
|
|
kwargs = args[0]
|
|
args = ()
|
|
- return str_type(vformat(f_self, args, kwargs))
|
|
|
|
+ return str_type(vformat(f_self, args, kwargs))
|
|
|
|
return update_wrapper(wrapper, value)
|
|
|
|
--
|
|
2.43.0
|
|
|