8000 [3.6] bpo-42103: Improve validation of Plist files. (GH-22882) by serhiy-storchaka · Pull Request #23118 · python/cpython · GitHub
[go: up one dir, main page]
Skip to content

[3.6] bpo-42103: Improve validation of Plist files. (GH-22882) #23118

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Nov 10, 2020
Merged

[3.6] bpo-42103: Improve validation of Plist files. (GH-22882) #23118

merged 1 commit into from
Nov 10, 2020

Conversation

serhiy-storchaka
Copy link
Member
@serhiy-storchaka serhiy-storchaka commented Nov 2, 2020 •
edited by bedevere-bot
Loading
  • Prevent some possible DoS attacks via providing invalid Plist files
    with extremely large number of objects or collection sizes.
  • Raise InvalidFileException for too large bytes and string size instead of returning garbage.
  • Raise InvalidFileException instead of ValueError for specific invalid datetime (NaN).
  • Raise InvalidFileException instead of TypeError for non-hashable dict keys.
  • Add more tests for invalid Plist files..
    (cherry picked from commit 34637a0)

Co-authored-by: Serhiy Storchaka storchaka@gmail.com

https://bugs.python.org/issue42103

@serhiy-storchaka
[3.6] bpo-42103: Improve validation of Plist files. (pythonGH-22882)
1c1dafb 
* Prevent some possible DoS attacks via providing invalid Plist files
  with extremely large number of objects or collection sizes.
* Raise InvalidFileException for too large bytes and string size instead of returning garbage.
* Raise InvalidFileException instead of ValueError for specific invalid datetime (NaN).
* Raise InvalidFileException instead of TypeError for non-hashable dict keys.
* Add more tests for invalid Plist files..
(cherry picked from commit 34637a0)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
@bedevere-bot bedevere-bot added type-bug An unexpected behavior, bug, or error type-security A security issue labels Nov 2, 2020
@bedevere-bot bedevere-bot mentioned this pull request Nov 2, 2020
Merged
@ned-deily ned-deily merged commit a63234c into python:3.6 Nov 10, 2020
@serhiy-storchaka serhiy-storchaka deleted the backport-34637a0-3.6 branch February 19, 2024 18:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
type-bug An unexpected behavior, bug, or error type-security A security issue
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@serhiy-storchaka @ned-deily @the-knights-who-say-ni @bedevere-bot
0