packages/python-reportlab
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
python-reportlab/backport-CVE-2023-33733-fix-RCE-attack-via-method-eval.patch
liningjie 8f2bde6d71 fix CVE-2023-33733 
(cherry picked from commit 781b66e45e73bb18cdfe65d6d270668581177b8c)
2023-07-26 14:29:05 +08:00

347 lines
16 KiB
Diff
Raw Blame History

From 1bd6d30aed39acb026f51c309b81d81e8b79e5ad Mon Sep 17 00:00:00 2001
From: liningjie <liningjie@xfusion.com>
Date: Sat, 17 Jun 2023 18:21:22 +0800
Subject: [PATCH] CVE-2023-33733 with rl_safe_eval & rl_config.toColorCanUse
changes
---
src/reportlab/lib/colors.py | 75 +++++++++++++++++++++++++------
src/reportlab/lib/rl_safe_eval.py | 71 ++++++++++++++++++++++++++++-
src/reportlab/lib/utils.py | 2 +-
src/reportlab/rl_settings.py | 5 ++-
tests/test_lib_rl_safe_eval.py | 49 ++++++++++++++++++--
5 files changed, 181 insertions(+), 21 deletions(-)
diff --git a/src/reportlab/lib/colors.py b/src/reportlab/lib/colors.py
index 84e8679..09d078f 100644
--- a/src/reportlab/lib/colors.py
+++ b/src/reportlab/lib/colors.py
@@ -41,7 +41,8 @@ ValueError: css color 'pcmyka(100,0,0,0)' has wrong number of components
'''
import math, re, functools
from reportlab.lib.rl_accel import fp_str
-from reportlab.lib.utils import asNative, isStr, rl_safe_eval
+from reportlab.lib.utils import asNative, isStr, rl_safe_eval, rl_extended_literal_eval
+from reportlab import rl_config
from ast import literal_eval
class Color:
@@ -835,6 +836,17 @@ class cssParse:
cssParse=cssParse()
class toColor:
+ """Accepot an expression returnng a Color subclass.
+
+ This used to accept arbitrary Python expressions, which resulted in increasngly devilish CVEs and
+ security holes from tie to time. In April 2023 we are creating explicit, "dumb" parsing code to
+ replace this. Acceptable patterns are
+
+ a Color instance passed in by the Python programmer
+ a named list of colours ('pink' etc')
+ list of 3 or 4 numbers
+ all CSS colour expression
+ """
_G = {} #globals we like (eventually)
def __init__(self):
@@ -860,21 +872,58 @@ class toColor:
C = getAllNamedColors()
s = arg.lower()
if s in C: return C[s]
- G = C.copy()
- G.update(self.extraColorsNS)
- if not self._G:
- C = globals()
- self._G = {s:C[s] for s in '''Blacker CMYKColor CMYKColorSep Color ColorType HexColor PCMYKColor PCMYKColorSep Whiter
- _chooseEnforceColorSpace _enforceCMYK _enforceError _enforceRGB _enforceSEP _enforceSEP_BLACK
- _enforceSEP_CMYK _namedColors _re_css asNative cmyk2rgb cmykDistance color2bw colorDistance
- cssParse describe fade fp_str getAllNamedColors hsl2rgb hue2rgb isStr linearlyInterpolatedColor
- literal_eval obj_R_G_B opaqueColor rgb2cmyk setColors toColor toColorOrNone'''.split()}
- G.update(self._G)
+
+
+ # allow expressions like 'Blacker(red, 0.5)'
+ # >>> re.compile(r"(Blacker|Whiter)\((\w+)\,\s?([0-9.]+)\)").match(msg).groups()
+ # ('Blacker', 'red', '0.5')
+ # >>>
+ pat = re.compile(r"(Blacker|Whiter)\((\w+)\,\s?([0-9.]+)\)")
+ m = pat.match(arg)
+ if m:
+ funcname, rootcolor, num = m.groups()
+ if funcname == 'Blacker':
+ return Blacker(rootcolor, float(num))
+ else:
+ return Whiter(rootcolor, float(num))
+
try:
- return toColor(rl_safe_eval(arg,g=G,l={}))
- except:
+ import ast
+ expr = ast.literal_eval(arg) #safe probably only a tuple or list of values
+ return toColor(expr)
+ except (SyntaxError, ValueError):
pass
+ if rl_config.toColorCanUse=='rl_safe_eval':
+ #the most dangerous option
+ G = C.copy()
+ G.update(self.extraColorsNS)
+ if not self._G:
+ C = globals()
+ self._G = {s:C[s] for s in '''Blacker CMYKColor CMYKColorSep Color ColorType HexColor PCMYKColor PCMYKColorSep Whiter
+ _chooseEnforceColorSpace _enforceCMYK _enforceError _enforceRGB _enforceSEP _enforceSEP_BLACK
+ _enforceSEP_CMYK _namedColors _re_css asNative cmyk2rgb cmykDistance color2bw colorDistance
+ cssParse describe fade fp_str getAllNamedColors hsl2rgb hue2rgb isStr linearlyInterpolatedColor
+ literal_eval obj_R_G_B opaqueColor rgb2cmyk setColors toColor toColorOrNone'''.split()}
+ G.update(self._G)
+ try:
+ return toColor(rl_safe_eval(arg,g=G,l={}))
+ except:
+ pass
+ elif rl_config.toColorCanUse=='rl_extended_literal_eval':
+ C = globals()
+ S = getAllNamedColors().copy()
+ C = {k:C[k] for k in '''Blacker CMYKColor CMYKColorSep Color ColorType HexColor PCMYKColor PCMYKColorSep Whiter
+ _chooseEnforceColorSpace _enforceCMYK _enforceError _enforceRGB _enforceSEP _enforceSEP_BLACK
+ _enforceSEP_CMYK _namedColors _re_css asNative cmyk2rgb cmykDistance color2bw colorDistance
+ cssParse describe fade fp_str getAllNamedColors hsl2rgb hue2rgb linearlyInterpolatedColor
+ obj_R_G_B opaqueColor rgb2cmyk setColors toColor toColorOrNone'''.split()
+ if callable(C.get(k,None))}
+ try:
+ return rl_extended_literal_eval(arg,C,S)
+ except (ValueError, SyntaxError):
+ pass
+
try:
return HexColor(arg)
except:
diff --git a/src/reportlab/lib/rl_safe_eval.py b/src/reportlab/lib/rl_safe_eval.py
index 49828c9..50834f6 100644
--- a/src/reportlab/lib/rl_safe_eval.py
+++ b/src/reportlab/lib/rl_safe_eval.py
@@ -3,7 +3,7 @@
#https://github.com/zopefoundation/RestrictedPython
#https://github.com/danthedeckie/simpleeval
#hopefully we are standing on giants' shoulders
-import sys, os, ast, re, weakref, time, copy, math
+import sys, os, ast, re, weakref, time, copy, math, types
eval_debug = int(os.environ.get('EVAL_DEBUG','0'))
strTypes = (bytes,str)
isPy39 = sys.version_info[:2]>=(3,9)
@@ -53,7 +53,9 @@ __rl_unsafe__ = frozenset('''builtins breakpoint __annotations__ co_argcount co_
func_doc func_globals func_name gi_code gi_frame gi_running gi_yieldfrom
__globals__ im_class im_func im_self __iter__ __kwdefaults__ __module__
__name__ next __qualname__ __self__ tb_frame tb_lasti tb_lineno tb_next
- globals vars locals'''.split()
+ globals vars locals
+ type eval exec aiter anext compile open
+ dir print classmethod staticmethod __import__ super property'''.split()
)
__rl_unsafe_re__ = re.compile(r'\b(?:%s)' % '|'.join(__rl_unsafe__),re.M)
@@ -1204,5 +1206,70 @@ class __rl_safe_eval__:
class __rl_safe_exec__(__rl_safe_eval__):
mode = 'exec'
+def rl_extended_literal_eval(expr, safe_callables=None, safe_names=None):
+ if safe_callables is None:
+ safe_callables = {}
+ if safe_names is None:
+ safe_names = {}
+ safe_names = safe_names.copy()
+ safe_names.update({'None': None, 'True': True, 'False': False})
+ #make these readonly with MappingProxyType
+ safe_names = types.MappingProxyType(safe_names)
+ safe_callables = types.MappingProxyType(safe_callables)
+ if isinstance(expr, str):
+ expr = ast.parse(expr, mode='eval')
+ if isinstance(expr, ast.Expression):
+ expr = expr.body
+ try:
+ # Python 3.4 and up
+ ast.NameConstant
+ safe_test = lambda n: isinstance(n, ast.NameConstant) or isinstance(n,ast.Name) and n.id in safe_names
+ safe_extract = lambda n: n.value if isinstance(n,ast.NameConstant) else safe_names[n.id]
+ except AttributeError:
+ # Everything before
+ safe_test = lambda n: isinstance(n, ast.Name) and n.id in safe_names
+ safe_extract = lambda n: safe_names[n.id]
+ def _convert(node):
+ if isinstance(node, (ast.Str, ast.Bytes)):
+ return node.s
+ elif isinstance(node, ast.Num):
+ return node.n
+ elif isinstance(node, ast.Tuple):
+ return tuple(map(_convert, node.elts))
+ elif isinstance(node, ast.List):
+ return list(map(_convert, node.elts))
+ elif isinstance(node, ast.Dict):
+ return dict((_convert(k), _convert(v)) for k, v
+ in zip(node.keys, node.values))
+ elif safe_test(node):
+ return safe_extract(node)
+ elif isinstance(node, ast.UnaryOp) and \
+ isinstance(node.op, (ast.UAdd, ast.USub)) and \
+ isinstance(node.operand, (ast.Num, ast.UnaryOp, ast.BinOp)):
+ operand = _convert(node.operand)
+ if isinstance(node.op, ast.UAdd):
+ return + operand
+ else:
+ return - operand
+ elif isinstance(node, ast.BinOp) and \
+ isinstance(node.op, (ast.Add, ast.Sub)) and \
+ isinstance(node.right, (ast.Num, ast.UnaryOp, ast.BinOp)) and \
+ isinstance(node.right.n, complex) and \
+ isinstance(node.left, (ast.Num, ast.UnaryOp, astBinOp)):
+ left = _convert(node.left)
+ right = _convert(node.right)
+ if isinstance(node.op, ast.Add):
+ return left + right
+ else:
+ return left - right
+ elif isinstance(node, ast.Call) and \
+ isinstance(node.func, ast.Name) and \
+ node.func.id in safe_callables:
+ return safe_callables[node.func.id](
+ *[_convert(n) for n in node.args],
+ **{kw.arg: _convert(kw.value) for kw in node.keywords})
+ raise ValueError('Bad expression')
+ return _convert(expr)
+
rl_safe_exec = __rl_safe_exec__()
rl_safe_eval = __rl_safe_eval__()
diff --git a/src/reportlab/lib/utils.py b/src/reportlab/lib/utils.py
index 5a6b5d7..a53a05c 100644
--- a/src/reportlab/lib/utils.py
+++ b/src/reportlab/lib/utils.py
@@ -11,7 +11,7 @@ from io import BytesIO
from hashlib import md5
from reportlab.lib.rltempfile import get_rl_tempfile, get_rl_tempdir
-from . rl_safe_eval import rl_safe_exec, rl_safe_eval, safer_globals
+from . rl_safe_eval import rl_safe_exec, rl_safe_eval, safer_globals, rl_extended_literal_eval
from PIL import Image
class __UNSET__:
diff --git a/src/reportlab/rl_settings.py b/src/reportlab/rl_settings.py
index 30e7547..1a9e520 100644
--- a/src/reportlab/rl_settings.py
+++ b/src/reportlab/rl_settings.py
@@ -67,7 +67,8 @@ documentLang
encryptionStrength
trustedHosts
trustedSchemes
-renderPMBackend'''.split())
+renderPMBackend
+toColorCanUse'''.split())
allowTableBoundsErrors = 1 # set to 0 to die on too large elements in tables in debug (recommend 1 for production use)
shapeChecking = 1
@@ -158,6 +159,8 @@ trustedSchemes=['file', 'rml', 'data', 'https', #these url schemes are trust
'http', 'ftp']
renderPMBackend='_renderPM' #or 'rlPyCairo' if available
+toColorCanUse='rl_extended_literal_eval' #change to None or 'rl_safe_eval' depending on trust
+
# places to look for T1Font information
T1SearchPath = (
'c:/Program Files/Adobe/Acrobat 9.0/Resource/Font',
diff --git a/tests/test_lib_rl_safe_eval.py b/tests/test_lib_rl_safe_eval.py
index 84bd86f..fd556eb 100644
--- a/tests/test_lib_rl_safe_eval.py
+++ b/tests/test_lib_rl_safe_eval.py
@@ -1,6 +1,6 @@
#Copyright ReportLab Europe Ltd. 2000-2017
#see license.txt for license details
-"""Tests for reportlab.lib.rl_eval
+"""Tests for reportlab.lib.rl_safe_eval
"""
__version__='3.5.33'
from reportlab.lib.testutils import setOutDir,makeSuiteForClasses, printLocation
@@ -10,7 +10,7 @@ import reportlab
from reportlab import rl_config
import unittest
from reportlab.lib import colors
-from reportlab.lib.utils import rl_safe_eval, rl_safe_exec, annotateException
+from reportlab.lib.utils import rl_safe_eval, rl_safe_exec, annotateException, rl_extended_literal_eval
from reportlab.lib.rl_safe_eval import BadCode
testObj = [1,('a','b',2),{'A':1,'B':2.0},"32"]
@@ -52,7 +52,6 @@ class SafeEvalTestSequenceMeta(type):
'dict(a=1).get("a",2)',
'dict(a=1).pop("a",2)',
'{"_":1+_ for _ in (1,2)}.pop(1,None)',
- '(type(1),type(str),type(testObj),type(TestClass))',
'1 if True else "a"',
'1 if False else "a"',
'testFunc(bad=False)',
@@ -74,6 +73,8 @@ class SafeEvalTestSequenceMeta(type):
(
'fail',
(
+ 'vars()',
+ '(type(1),type(str),type(testObj),type(TestClass))',
'open("/tmp/myfile")',
'SafeEvalTestCase.__module__',
("testInst.__class__.__bases__[0].__subclasses__()",dict(g=dict(testInst=testInst))),
@@ -97,6 +98,8 @@ class SafeEvalTestSequenceMeta(type):
'testFunc(bad=True)',
'getattr(testInst,"__class__",14)',
'"{1}{2}".format(1,2)',
+ 'builtins',
+ '[ [ [ [ ftype(ctype(0, 0, 0, 0, 3, 67, b"t\\x00d\\x01\\x83\\x01\\xa0\\x01d\\x02\\xa1\\x01\\x01\\x00d\\x00S\\x00", (None, "os", "touch /tmp/exploited"), ("__import__", "system"), (), "<stdin>", "", 1, b"\\x12\\x01"), {})() for ftype in [type(lambda: None)] ] for ctype in [type(getattr(lambda: {None}, Word("__code__")))] ] for Word in [orgTypeFun("Word", (str,), { "mutated": 1, "startswith": lambda self, x: False, "__eq__": lambda self,x: self.mutate() and self.mutated < 0 and str(self) == x, "mutate": lambda self: {setattr(self, "mutated", self.mutated - 1)}, "__hash__": lambda self: hash(str(self)) })] ] for orgTypeFun in [type(type(1))]] and "red"',
)
),
):
@@ -155,8 +158,46 @@ class SafeEvalTestBasics(unittest.TestCase):
def test_002(self):
self.assertTrue(rl_safe_eval("GA=='ga'"))
+class ExtendedLiteralEval(unittest.TestCase):
+ def test_001(self):
+ S = colors.getAllNamedColors().copy()
+ C = {s:getattr(colors,s) for s in '''Blacker CMYKColor CMYKColorSep Color ColorType HexColor PCMYKColor PCMYKColorSep Whiter
+ _chooseEnforceColorSpace _enforceCMYK _enforceError _enforceRGB _enforceSEP _enforceSEP_BLACK
+ _enforceSEP_CMYK _namedColors _re_css asNative cmyk2rgb cmykDistance color2bw colorDistance
+ cssParse describe fade fp_str getAllNamedColors hsl2rgb hue2rgb linearlyInterpolatedColor
+ obj_R_G_B opaqueColor rgb2cmyk setColors toColor toColorOrNone'''.split()
+ if callable(getattr(colors,s,None))}
+ def showVal(s):
+ try:
+ r = rl_extended_literal_eval(s,C,S)
+ except:
+ r = str(sys.exc_info()[1])
+ return r
+
+ for expr, expected in (
+ ('1.0', 1.0),
+ ('1', 1),
+ ('red', colors.red),
+ ('True', True),
+ ('False', False),
+ ('None', None),
+ ('Blacker(red,0.5)', colors.Color(.5,0,0,1)),
+ ('PCMYKColor(21,10,30,5,spotName="ABCD")', colors.PCMYKColor(21,10,30,5,spotName='ABCD',alpha=100)),
+ ('HexColor("#ffffff")', colors.Color(1,1,1,1)),
+ ('linearlyInterpolatedColor(red, blue, 0, 1, 0.5)', colors.Color(.5,0,.5,1)),
+ ('red.rgb()', 'Bad expression'),
+ ('__import__("sys")', 'Bad expression'),
+ ('globals()', 'Bad expression'),
+ ('locals()', 'Bad expression'),
+ ('vars()', 'Bad expression'),
+ ('builtins', 'Bad expression'),
+ ('__file__', 'Bad expression'),
+ ('__name__', 'Bad expression'),
+ ):
+ self.assertEqual(showVal(expr),expected,f"rl_extended_literal_eval({expr!r}) is not equal to expected {expected}")
+
def makeSuite():
- return makeSuiteForClasses(SafeEvalTestCase,SafeEvalTestBasics)
+ return makeSuiteForClasses(SafeEvalTestCase,SafeEvalTestBasics,ExtendedLiteralEval)
if __name__ == "__main__": #noruntests
unittest.TextTestRunner().run(makeSuite())
--
2.30.0.windows.2
Reference in New Issue View Git Blame Copy Permalink