Race conditions in shutil.copy, shutil.copy2 and shutil.copyfile

未关闭
#59,305 6 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
25/100
Issue 类型
缺陷
描述清晰度
需要澄清
活跃度
停滞
技术栈
python
领域
backend, security

调研方向

Start with the current implementations of shutil.copy, shutil.copy2, and shutil.copyfile, then review the linked python_shutil_copyfile.diff and python_shutil_copy_with_umask.diff patches. Compare their proposed handling of race conditions and umask-related disclosure with the open issue; done means the security concerns are addressed and the relevant behavior is covered by the project's existing checks.

由索引模型根据 Issue 内容生成。

描述

3.7 (EOL) stdlib type-security
BPO 15100
Nosy @loewis, @pitrou, @giampaolo, @florentx, @hynek, @jimjjewett
Files
  • python_shutil_copyfile.diff: A patch for copyfile procedure
  • python_shutil_copy_with_umask.diff: A patch for the disclosure bug only
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
closed_at = None
created_at = <Date 2012-06-18.11:57:48.316>
labels = ['type-security', '3.7', 'library', 'expert-IO']
title = 'Race conditions in shutil.copy, shutil.copy2 and shutil.copyfile'
updated_at = <Date 2018-08-13.12:48:25.884>
user = 'https://bugs.python.org/radoslawzarzynski'

    bugs.python.org fields:

    activity = <Date 2018-08-13.12:48:25.884>
actor = 'Jim.Jewett'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Library (Lib)', 'IO']
creation = <Date 2012-06-18.11:57:48.316>
creator = 'radoslaw.zarzynski'
dependencies = []
files = ['26042', '26043']
hgrepos = []
issue_num = 15100
keywords = []
message_count = 6.0
messages = ['163096', '163160', '185124', '185125', '213975', '323481']
nosy_count = 10.0
nosy_names = ['loewis', 'pitrou', 'giampaolo.rodola', 'Arfrever', 'flox', 'neologix', 'hynek', 'Jim.Jewett', 'radoslaw.zarzynski', 'jm']
pr_nums = []
priority = 'high'
resolution = None
stage = 'needs patch'
status = 'open'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue15100'
versions = ['Python 2.7', 'Python 3.5', 'Python 3.6', 'Python 3.7']

    主要语言
    Python
    星标
    77.2k
    派生
    36k
    平均合并
    1 天 9 小时
    30 天内合并 PR
    558

    贡献指南

    打开贡献指南

    从这里开始

    1. 先读完整个 Issue，再读项目的贡献指南。
    2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
    3. Fork 仓库，在一个分支上完成修改。
    4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

    python/cpython 的其他 Issue

    查看 python/cpython 的全部 Issue

    相似的 Issue

    更多 Python Issue

    把新 issue 发到你的邮箱

    精选适合新手参与的 GitHub issue 摘要。