diff options
author | V3n3RiX <venerix@redcorelinux.org> | 2020-02-05 18:44:56 +0000 |
---|---|---|
committer | V3n3RiX <venerix@redcorelinux.org> | 2020-02-05 18:44:56 +0000 |
commit | 29aabba0ea759c6a2864ff5631735b67ee38e5e0 (patch) | |
tree | ab466b4dfa7abecb401b2f8039d08af4689306bb /dev-python/pyxdg/files | |
parent | d42200bec37eef2a7478d88988ff00addd0a9202 (diff) |
gentoo resync : 05.02.2020
Diffstat (limited to 'dev-python/pyxdg/files')
-rw-r--r-- | dev-python/pyxdg/files/sec-patch-CVE-2014-1624.patch | 54 |
1 files changed, 0 insertions, 54 deletions
diff --git a/dev-python/pyxdg/files/sec-patch-CVE-2014-1624.patch b/dev-python/pyxdg/files/sec-patch-CVE-2014-1624.patch deleted file mode 100644 index d94c0a42bddb..000000000000 --- a/dev-python/pyxdg/files/sec-patch-CVE-2014-1624.patch +++ /dev/null @@ -1,54 +0,0 @@ -Improve security of get_runtime_dir(strict=False) -https://github.com/takluyver/pyxdg/commit/bd999c1c3fe7ee5f30ede2cf704cf03e400347b4 -diff --git a/xdg/BaseDirectory.py b/xdg/BaseDirectory.py -index cececa3..a7c31b1 100644 ---- a/xdg/BaseDirectory.py -+++ b/xdg/BaseDirectory.py -@@ -25,7 +25,7 @@ - Note: see the rox.Options module for a higher-level API for managing options. - """ - --import os -+import os, stat - - _home = os.path.expanduser('~') - xdg_data_home = os.environ.get('XDG_DATA_HOME') or \ -@@ -131,15 +131,30 @@ def get_runtime_dir(strict=True): - - import getpass - fallback = '/tmp/pyxdg-runtime-dir-fallback-' + getpass.getuser() -+ create = False -+ - try: -- os.mkdir(fallback, 0o700) -+ # This must be a real directory, not a symlink, so attackers can't -+ # point it elsewhere. So we use lstat to check it. -+ st = os.lstat(fallback) - except OSError as e: - import errno -- if e.errno == errno.EEXIST: -- # Already exists - set 700 permissions again. -- import stat -- os.chmod(fallback, stat.S_IRUSR|stat.S_IWUSR|stat.S_IXUSR) -- else: # pragma: no cover -+ if e.errno == errno.ENOENT: -+ create = True -+ else: - raise -- -+ else: -+ # The fallback must be a directory -+ if not stat.S_ISDIR(st.st_mode): -+ os.unlink(fallback) -+ create = True -+ # Must be owned by the user and not accessible by anyone else -+ elif (st.st_uid != os.getuid()) \ -+ or (st.st_mode & (stat.S_IRWXG | stat.S_IRWXO)): -+ os.rmdir(fallback) -+ create = True -+ -+ if create: -+ os.mkdir(fallback, 0o700) -+ - return fallback - |