python / python/cpython

[security] directory traversal in tempfile prefix

Open
#79,459 8 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

3.10 3.11 3.12 3.13 3.8 (EOL) 3.9 (EOL) stdlib type-security
Dominant language
Python
Stars
77.2k
Forks
36k
Avg merge
1d 9h
Merged PRs (30d)
558

Description

BPO 35278
Nosy @mjpieters, @vstinner, @ambv, @csabella, @Thorleon, @obestwalter
PRs
  • python/cpython#10627
  • Files
  • bpo-35278.patch
  • Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
    closed_at = None
    created_at = <Date 2018-11-19.12:46:03.177>
    labels = ['type-security', '3.8', '3.9', '3.10', '3.7', 'library']
    title = '[security] directory traversal in tempfile prefix'
    updated_at = <Date 2021-03-14.02:25:00.048>
    user = 'https://bugs.python.org/YusukeEndoh'
    

    bugs.python.org fields:

    activity = <Date 2021-03-14.02:25:00.048>
    actor = 'gregory.p.smith'
    assignee = 'none'
    closed = False
    closed_date = None
    closer = None
    components = ['Library (Lib)']
    creation = <Date 2018-11-19.12:46:03.177>
    creator = 'Yusuke Endoh'
    dependencies = []
    files = ['47939']
    hgrepos = []
    issue_num = 35278
    keywords = ['patch']
    message_count = 6.0
    messages = ['330097', '330100', '330169', '335174', '340205', '356299']
    nosy_count = 7.0
    nosy_names = ['mjpieters', 'vstinner', 'lukasz.langa', 'cheryl.sabella', 'Yusuke Endoh', 'thorleon', 'obestwalter']
    pr_nums = ['10627']
    priority = 'normal'
    resolution = None
    stage = 'patch review'
    status = 'open'
    superseder = None
    type = 'security'
    url = 'https://bugs.python.org/issue35278'
    versions = ['Python 3.6', 'Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10']
    

    Linked PRs
    • gh-143889
    • gh-150477

    Contributor guide

    Open the contributing guide

    First steps

    1. Read the whole issue, then the project's contributing guide.
    2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
    3. Fork the repository and make your change on a branch.
    4. Open a pull request that references the issue number.

    Research direction

    Start with the bpo-35278.patch file and the linked PRs gh-143889 and gh-150477, then inspect the tempfile code under Lib. Determine the intended handling for directory traversal in the tempfile prefix and verify the behavior with the relevant library tests.

    Written by the indexing model from the issue text.

    Assessment

    Tech stack
    python
    Domain
    security
    Issue type
    Bug
    Difficulty
    4/5
    Estimated time
    3-5 days
    Activity status
    Stale
    Clarity
    Needs clarification
    Newbie friendliness
    20/100

    Get new issues in your inbox

    A short digest of beginner-friendly GitHub issues.