File CVE-2024-53899.patch of Package python-virtualenv.36516
Index: virtualenv-20.22.0/docs/changelog/2768.bugfix.rst
===================================================================
--- /dev/null
+++ virtualenv-20.22.0/docs/changelog/2768.bugfix.rst
@@ -0,0 +1,2 @@
+Properly quote string placeholders in activation script templates to mitigate
+potential command injection - by :user:`y5c4l3`.
Index: virtualenv-20.22.0/src/virtualenv/activation/bash/activate.sh
===================================================================
--- virtualenv-20.22.0.orig/src/virtualenv/activation/bash/activate.sh
+++ virtualenv-20.22.0/src/virtualenv/activation/bash/activate.sh
@@ -44,14 +44,14 @@ deactivate () {
# unset irrelevant variables
deactivate nondestructive
-VIRTUAL_ENV='__VIRTUAL_ENV__'
+VIRTUAL_ENV=__VIRTUAL_ENV__
if ([ "$OSTYPE" = "cygwin" ] || [ "$OSTYPE" = "msys" ]) && $(command -v cygpath &> /dev/null) ; then
VIRTUAL_ENV=$(cygpath -u "$VIRTUAL_ENV")
fi
export VIRTUAL_ENV
_OLD_VIRTUAL_PATH="$PATH"
-PATH="$VIRTUAL_ENV/__BIN_NAME__:$PATH"
+PATH="$VIRTUAL_ENV/"__BIN_NAME__":$PATH"
export PATH
# unset PYTHONHOME if set
@@ -62,7 +62,7 @@ fi
if [ -z "${VIRTUAL_ENV_DISABLE_PROMPT-}" ] ; then
_OLD_VIRTUAL_PS1="${PS1-}"
- if [ "x__VIRTUAL_PROMPT__" != x ] ; then
+ if [ "x"__VIRTUAL_PROMPT__ != x ] ; then
PS1="(__VIRTUAL_PROMPT__) ${PS1-}"
else
PS1="(`basename \"$VIRTUAL_ENV\"`) ${PS1-}"
Index: virtualenv-20.22.0/src/virtualenv/activation/batch/__init__.py
===================================================================
--- virtualenv-20.22.0.orig/src/virtualenv/activation/batch/__init__.py
+++ virtualenv-20.22.0/src/virtualenv/activation/batch/__init__.py
@@ -15,6 +15,10 @@ class BatchActivator(ViaTemplateActivato
yield "deactivate.bat"
yield "pydoc.bat"
+ @staticmethod
+ def quote(string):
+ return string
+
def instantiate_template(self, replacements, template, creator):
# ensure the text has all newlines as \r\n - required by batch
base = super().instantiate_template(replacements, template, creator)
Index: virtualenv-20.22.0/src/virtualenv/activation/cshell/activate.csh
===================================================================
--- virtualenv-20.22.0.orig/src/virtualenv/activation/cshell/activate.csh
+++ virtualenv-20.22.0/src/virtualenv/activation/cshell/activate.csh
@@ -10,15 +10,15 @@ alias deactivate 'test $?_OLD_VIRTUAL_PA
# Unset irrelevant variables.
deactivate nondestructive
-setenv VIRTUAL_ENV '__VIRTUAL_ENV__'
+setenv VIRTUAL_ENV __VIRTUAL_ENV__
set _OLD_VIRTUAL_PATH="$PATH:q"
-setenv PATH "$VIRTUAL_ENV:q/__BIN_NAME__:$PATH:q"
+setenv PATH "$VIRTUAL_ENV:q/"__BIN_NAME__":$PATH:q"
-if ('__VIRTUAL_PROMPT__' != "") then
- set env_name = '(__VIRTUAL_PROMPT__) '
+if (__VIRTUAL_PROMPT__ != "") then
+ setenv VIRTUAL_ENV_PROMPT __VIRTUAL_PROMPT__
else
set env_name = '('"$VIRTUAL_ENV:t:q"') '
endif
Index: virtualenv-20.22.0/src/virtualenv/activation/fish/activate.fish
===================================================================
--- virtualenv-20.22.0.orig/src/virtualenv/activation/fish/activate.fish
+++ virtualenv-20.22.0/src/virtualenv/activation/fish/activate.fish
@@ -57,7 +57,7 @@ end
# Unset irrelevant variables.
deactivate nondestructive
-set -gx VIRTUAL_ENV '__VIRTUAL_ENV__'
+set -gx VIRTUAL_ENV __VIRTUAL_ENV__
# https://github.com/fish-shell/fish-shell/issues/436 altered PATH handling
if test (echo $FISH_VERSION | head -c 1) -lt 3
@@ -65,7 +65,7 @@ if test (echo $FISH_VERSION | head -c 1)
else
set -gx _OLD_VIRTUAL_PATH $PATH
end
-set -gx PATH "$VIRTUAL_ENV"'/__BIN_NAME__' $PATH
+set -gx PATH "$VIRTUAL_ENV"'/'__BIN_NAME__ $PATH
# Unset `$PYTHONHOME` if set.
if set -q PYTHONHOME
@@ -87,8 +87,8 @@ if test -z "$VIRTUAL_ENV_DISABLE_PROMPT"
# Prompt override provided?
# If not, just prepend the environment name.
- if test -n '__VIRTUAL_PROMPT__'
- printf '(%s) ' '__VIRTUAL_PROMPT__'
+ if test -n __VIRTUAL_PROMPT__
+ printf '(%s) ' __VIRTUAL_PROMPT__
else
printf '(%s) ' (basename "$VIRTUAL_ENV")
end
Index: virtualenv-20.22.0/src/virtualenv/activation/nushell/__init__.py
===================================================================
--- virtualenv-20.22.0.orig/src/virtualenv/activation/nushell/__init__.py
+++ virtualenv-20.22.0/src/virtualenv/activation/nushell/__init__.py
@@ -7,6 +7,25 @@ class NushellActivator(ViaTemplateActiva
def templates(self):
yield "activate.nu"
+ @staticmethod
+ def quote(string):
+ """
+ Nushell supports raw strings like: r###'this is a string'###.
+
+ This method finds the maximum continuous sharps in the string and then
+ quote it with an extra sharp.
+ """
+ max_sharps = 0
+ current_sharps = 0
+ for char in string:
+ if char == "#":
+ current_sharps += 1
+ max_sharps = max(current_sharps, max_sharps)
+ else:
+ current_sharps = 0
+ wrapping = "#" * (max_sharps + 1)
+ return f"r{wrapping}'{string}'{wrapping}"
+
def replacements(self, creator, dest_folder): # noqa: U100
return {
"__VIRTUAL_PROMPT__": "" if self.flag_prompt is None else self.flag_prompt,
Index: virtualenv-20.22.0/src/virtualenv/activation/nushell/activate.nu
===================================================================
--- virtualenv-20.22.0.orig/src/virtualenv/activation/nushell/activate.nu
+++ virtualenv-20.22.0/src/virtualenv/activation/nushell/activate.nu
@@ -31,8 +31,8 @@ export-env {
}
let is_windows = ($nu.os-info.name | str downcase) == 'windows'
- let virtual_env = '__VIRTUAL_ENV__'
- let bin = '__BIN_NAME__'
+ let virtual_env = __VIRTUAL_ENV__
+ let bin = __BIN_NAME__
let path_sep = (char esep)
let path_name = (if $is_windows {
if (has-env 'Path') {
@@ -73,10 +73,10 @@ export-env {
$new_env
} else {
# Creating the new prompt for the session
- let virtual_prompt = (if ('__VIRTUAL_PROMPT__' == '') {
+ let virtual_prompt = (if (__VIRTUAL_PROMPT__ == '') {
$'(char lparen)($virtual_env | path basename)(char rparen) '
} else {
- '(__VIRTUAL_PROMPT__) '
+ __VIRTUAL_PROMPT__
})
# Back up the old prompt builder
Index: virtualenv-20.22.0/src/virtualenv/activation/powershell/__init__.py
===================================================================
--- virtualenv-20.22.0.orig/src/virtualenv/activation/powershell/__init__.py
+++ virtualenv-20.22.0/src/virtualenv/activation/powershell/__init__.py
@@ -7,6 +7,18 @@ class PowerShellActivator(ViaTemplateAct
def templates(self):
yield "activate.ps1"
+ @staticmethod
+ def quote(string):
+ """
+ This should satisfy PowerShell quoting rules [1], unless the quoted
+ string is passed directly to Windows native commands [2].
+
+ [1]: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_quoting_rules
+ [2]: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_parsing#passing-arguments-that-contain-quote-characters
+ """ # noqa: D205
+ string = string.replace("'", "''")
+ return f"'{string}'"
+
__all__ = [
"PowerShellActivator",
Index: virtualenv-20.22.0/src/virtualenv/activation/powershell/activate.ps1
===================================================================
--- virtualenv-20.22.0.orig/src/virtualenv/activation/powershell/activate.ps1
+++ virtualenv-20.22.0/src/virtualenv/activation/powershell/activate.ps1
@@ -35,14 +35,14 @@ $env:VIRTUAL_ENV = $VIRTUAL_ENV
New-Variable -Scope global -Name _OLD_VIRTUAL_PATH -Value $env:PATH
-$env:PATH = "$env:VIRTUAL_ENV/__BIN_NAME____PATH_SEP__" + $env:PATH
+$env:PATH = "$env:VIRTUAL_ENV/" + __BIN_NAME__ + __PATH_SEP__ + $env:PATH
if (!$env:VIRTUAL_ENV_DISABLE_PROMPT) {
function global:_old_virtual_prompt {
""
}
$function:_old_virtual_prompt = $function:prompt
- if ("__VIRTUAL_PROMPT__" -ne "") {
+ if (__VIRTUAL_PROMPT__ -ne "") {
function global:prompt {
# Add the custom prefix to the existing prompt
$previous_prompt_value = & $function:_old_virtual_prompt
Index: virtualenv-20.22.0/src/virtualenv/activation/python/__init__.py
===================================================================
--- virtualenv-20.22.0.orig/src/virtualenv/activation/python/__init__.py
+++ virtualenv-20.22.0/src/virtualenv/activation/python/__init__.py
@@ -10,12 +10,17 @@ class PythonActivator(ViaTemplateActivat
def templates(self):
yield "activate_this.py"
+ @staticmethod
+ def quote(string):
+ return repr(string)
+
def replacements(self, creator, dest_folder):
replacements = super().replacements(creator, dest_folder)
lib_folders = OrderedDict((os.path.relpath(str(i), str(dest_folder)), None) for i in creator.libs)
+ lib_folders = os.pathsep.join(lib_folders.keys())
replacements.update(
{
- "__LIB_FOLDERS__": os.pathsep.join(lib_folders.keys()),
+ "__LIB_FOLDERS__": lib_folders,
"__DECODE_PATH__": "",
},
)
Index: virtualenv-20.22.0/src/virtualenv/activation/python/activate_this.py
===================================================================
--- virtualenv-20.22.0.orig/src/virtualenv/activation/python/activate_this.py
+++ virtualenv-20.22.0/src/virtualenv/activation/python/activate_this.py
@@ -16,17 +16,18 @@ except NameError:
raise AssertionError("You must use exec(open(this_file).read(), {'__file__': this_file}))")
bin_dir = os.path.dirname(abs_file)
-base = bin_dir[: -len("__BIN_NAME__") - 1] # strip away the bin part from the __file__, plus the path separator
+base = bin_dir[: -len(__BIN_NAME__) - 1] # strip away the bin part from the __file__, plus the path separator
# prepend bin to PATH (this file is inside the bin directory)
os.environ["PATH"] = os.pathsep.join([bin_dir] + os.environ.get("PATH", "").split(os.pathsep))
os.environ["VIRTUAL_ENV"] = base # virtual env is right above bin directory
+os.environ["VIRTUAL_ENV_PROMPT"] = __VIRTUAL_PROMPT__ or os.path.basename(base)
# add the virtual environments libraries to the host python import mechanism
prev_length = len(sys.path)
-for lib in "__LIB_FOLDERS__".split(os.pathsep):
+for lib in __LIB_FOLDERS__.split(os.pathsep):
path = os.path.realpath(os.path.join(bin_dir, lib))
- site.addsitedir(path.decode("utf-8") if "__DECODE_PATH__" else path)
+ site.addsitedir(path.decode("utf-8") if __DECODE_PATH__ else path)
sys.path[:] = sys.path[prev_length:] + sys.path[0:prev_length]
sys.real_prefix = sys.prefix
Index: virtualenv-20.22.0/src/virtualenv/activation/via_template.py
===================================================================
--- virtualenv-20.22.0.orig/src/virtualenv/activation/via_template.py
+++ virtualenv-20.22.0/src/virtualenv/activation/via_template.py
@@ -1,6 +1,7 @@
from __future__ import annotations
import os
+import shlex
import sys
from abc import ABCMeta, abstractmethod
@@ -21,6 +22,16 @@ class ViaTemplateActivator(Activator, me
def templates(self):
raise NotImplementedError
+ @staticmethod
+ def quote(string):
+ """
+ Quote strings in the activation script.
+
+ :param string: the string to quote
+ :return: quoted string that works in the activation script
+ """
+ return shlex.quote(string)
+
def generate(self, creator):
dest_folder = creator.bin_dir
replacements = self.replacements(creator, dest_folder)
@@ -57,7 +68,7 @@ class ViaTemplateActivator(Activator, me
text = binary.decode("utf-8", errors="strict")
for key, value in replacements.items():
value = self._repr_unicode(creator, value)
- text = text.replace(key, value)
+ text = text.replace(key, self.quote(value))
return text
@staticmethod
Index: virtualenv-20.22.0/tests/conftest.py
===================================================================
--- virtualenv-20.22.0.orig/tests/conftest.py
+++ virtualenv-20.22.0/tests/conftest.py
@@ -293,7 +293,11 @@ def is_inside_ci():
@pytest.fixture(scope="session")
def special_char_name():
- base = "e-$ Γ¨ΡΡπβδΈη-j"
+ base = "'\";&&e-$ Γ¨ΡΡπβδΈη-j"
+ if IS_WIN:
+ # get rid of invalid characters on Windows
+ base = base.replace('"', "")
+ base = base.replace(";", "")
# workaround for pypy3 https://bitbucket.org/pypy/pypy/issues/3147/venv-non-ascii-support-windows
encoding = "ascii" if IS_WIN else sys.getfilesystemencoding()
# let's not include characters that the file system cannot encode)
