Repository navigation
0.3.3: treat the package index as untrusted in mpat diff - #12
Merged
Merged
Conversation
The index page decides both the archive filename, which becomes a path in the cache, and the download URL. packaging accepts an sdist name like ../../x-1.0.tar.gz, and urllib happily opens file:// URLs, so a hostile or tampered index could write outside MPAT_CACHE_DIR or read local files. Only archives named for the locked project and only http(s) links are used now. Error messages also drop query strings and userinfo, since signed object-storage URLs carry their token in the query and these messages land in CI logs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The index page controls the archive filename (a cache path) and the download URL.
packagingaccepts sdist names like../../x-1.0.tar.gzand urllib opensfile://, so a hostile or tampered index could write outsideMPAT_CACHE_DIRor read a local file. Only archives named for the locked project and only http(s) links are used now, and error messages drop query strings and userinfo so signed download URLs stay out of CI logs.Found by a background security review of 0.3.2. Exposure needs a malicious or MITM'd index and an opt-in
--diff/mpat diffrun. 382 tests pass on 3.11-3.14.