mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-09-09 18:50:13 +00:00
Hetvi Thakar
6752204aad
Manually backport the three upstream security fixes for CVE-2026-32640 to the Scarthgap simpleeval 0.9.13 recipe [1][2][3]. Include the required unhashable-container correction [4], which prevents the recursive security checks from raising TypeError on legitimate list and tuple values. Harden the recursive callback-argument validation to inspect sets, frozensets, and dictionary keys, and safely handle cyclic containers. Add regression coverage for each of these cases. Do not include the separate generator/coroutine hardening or the optional performance follow-up. Omit the new ModuleWrapper API so this stable-branch fix adds no unrelated public feature. [1] https://github.com/danthedeckie/simpleeval/commit/9cb4a7b99498 [2] https://github.com/danthedeckie/simpleeval/commit/1654cbf02193 [3] https://github.com/danthedeckie/simpleeval/commit/cffa9f68cee5 [4] https://github.com/danthedeckie/simpleeval/commit/d1e4569db678 Signed-off-by: Hetvi Thakar <hthakar@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
56 lines
1.6 KiB
Diff
56 lines
1.6 KiB
Diff
From 1f59b001d140f3c35b813150de48509bcc61713d Mon Sep 17 00:00:00 2001
|
|
From: Daniel Fairhead <daniel@dev.ngo>
|
|
Date: Thu, 12 Mar 2026 09:33:17 +0000
|
|
Subject: [PATCH 1/4] Add a few additional DISALLOW_FUNCTIONS
|
|
|
|
CVE: CVE-2026-32640
|
|
Upstream-Status: Backport [https://github.com/danthedeckie/simpleeval/commit/9cb4a7b99498c173263bd90f77bc185e160fb6b8]
|
|
|
|
Backport Changes:
|
|
- Add exec while expanding DISALLOW_FUNCTIONS because simpleeval 0.9.13 does not contain the earlier generator-hardening change that added it.
|
|
|
|
(cherry picked from commit 9cb4a7b99498c173263bd90f77bc185e160fb6b8)
|
|
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
|
|
---
|
|
simpleeval.py | 17 ++++++++++++++++-
|
|
1 file changed, 16 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/simpleeval.py b/simpleeval.py
|
|
index f6a3ed6..91ed582 100644
|
|
--- a/simpleeval.py
|
|
+++ b/simpleeval.py
|
|
@@ -98,6 +98,7 @@ well:
|
|
|
|
import ast
|
|
import operator as op
|
|
+import os
|
|
import sys
|
|
import warnings
|
|
from random import random
|
|
@@ -123,7 +124,21 @@ DISALLOW_METHODS = ["format", "format_map", "mro"]
|
|
# their functionality is required, then please wrap them up in a safe container. And think
|
|
# very hard about it first. And don't say I didn't warn you.
|
|
# builtins is a dict in python >3.6 but a module before
|
|
-DISALLOW_FUNCTIONS = {type, isinstance, eval, getattr, setattr, repr, compile, open}
|
|
+DISALLOW_FUNCTIONS = {
|
|
+ type,
|
|
+ isinstance,
|
|
+ eval,
|
|
+ getattr,
|
|
+ setattr,
|
|
+ repr,
|
|
+ compile,
|
|
+ open,
|
|
+ exec,
|
|
+ globals,
|
|
+ locals,
|
|
+ os.popen,
|
|
+ os.system,
|
|
+}
|
|
if hasattr(__builtins__, "help") or (
|
|
hasattr(__builtins__, "__contains__") and "help" in __builtins__ # type: ignore
|
|
):
|
|
--
|
|
2.35.6
|
|
|