File CVE-2024-56326.patch of Package python-Jinja2.37840

From 91a972f5808973cd441f4dc06873b2f8378f30c7 Mon Sep 17 00:00:00 2001
From: Lydxn <hlyndon20@gmail.com>
Date: Mon, 23 Sep 2024 15:09:10 -0700
Subject: [PATCH] sandbox indirect calls to str.format

---
 jinja2/sandbox.py  | 81 ++++++++++++++++++++++--------------------
 tests/test_security.py | 17 +++++++++
 2 files changed, 60 insertions(+), 38 deletions(-)

Index: Jinja2-2.10.1/jinja2/sandbox.py
===================================================================
--- Jinja2-2.10.1.orig/jinja2/sandbox.py
+++ Jinja2-2.10.1/jinja2/sandbox.py
@@ -18,6 +18,7 @@ from collections import Mapping
 from jinja2.environment import Environment
 from jinja2.exceptions import SecurityError
 from jinja2._compat import string_types, PY2
+from functools import update_wrapper
 from jinja2.utils import Markup
 
 from markupsafe import EscapeFormatter
@@ -134,16 +135,6 @@ class _MagicFormatMapping(Mapping):
         return len(self._kwargs)
 
 
-def inspect_format_method(callable):
-    if not isinstance(callable, (types.MethodType,
-                                 types.BuiltinMethodType)) or \
-       callable.__name__ not in ('format', 'format_map'):
-        return None
-    obj = callable.__self__
-    if isinstance(obj, string_types):
-        return obj
-
-
 def safe_range(*args):
     """A range that can't generate ranges with a length of more than
     MAX_RANGE items.
@@ -372,6 +363,9 @@ class SandboxedEnvironment(Environment):
                     except AttributeError:
                         pass
                     else:
+                        fmt = self.wrap_str_format(value)
+                        if fmt is not None:
+                            return fmt
                         if self.is_safe_attribute(obj, argument, value):
                             return value
                         return self.unsafe_undefined(obj, argument)
@@ -389,6 +383,9 @@ class SandboxedEnvironment(Environment):
             except (TypeError, LookupError):
                 pass
         else:
+            fmt = self.wrap_str_format(value)
+            if fmt is not None:
+                return fmt
             if self.is_safe_attribute(obj, attribute, value):
                 return value
             return self.unsafe_undefined(obj, attribute)
@@ -402,34 +399,52 @@ class SandboxedEnvironment(Environment):
             obj.__class__.__name__
         ), name=attribute, obj=obj, exc=SecurityError)
 
-    def format_string(self, s, args, kwargs, format_func=None):
-        """If a format call is detected, then this is routed through this
-        method so that our safety sandbox can be used for it.
+
+    def wrap_str_format(self, value):
+        """If the given value is a ``str.format`` or ``str.format_map`` method,
+        return a new function than handles sandboxing. This is done at access
+        rather than in :meth:`call`, so that calls made without ``call`` are
+        also sandboxed.
         """
-        if isinstance(s, Markup):
-            formatter = SandboxedEscapeFormatter(self, s.escape)
+        if not isinstance(
+            value, (types.MethodType, types.BuiltinMethodType)
+        ) or value.__name__ not in ("format", "format_map"):
+            return None
+
+        f_self = value.__self__
+
+        if not isinstance(f_self, str):
+            return None
+
+        str_type = type(f_self)
+        is_format_map = value.__name__ == "format_map"
+
+        if isinstance(f_self, Markup):
+            formatter = SandboxedEscapeFormatter(self, f_self.escape)
         else:
             formatter = SandboxedFormatter(self)
 
-        if format_func is not None and format_func.__name__ == 'format_map':
-            if len(args) != 1 or kwargs:
-                raise TypeError(
-                    'format_map() takes exactly one argument %d given'
-                    % (len(args) + (kwargs is not None))
-                )
-
-            kwargs = args[0]
-            args = None
-
-        kwargs = _MagicFormatMapping(args, kwargs)
-        rv = formatter.vformat(s, args, kwargs)
-        return type(s)(rv)
+        vformat = formatter.vformat
+
+        def wrapper(*args, **kwargs):
+            if is_format_map:
+                if kwargs:
+                    raise TypeError("format_map() takes no keyword arguments")
+
+                if len(args) != 1:
+                    raise TypeError(
+                        "format_map() takes exactly one argument (%s given)" % len(args)
+                    )
+
+                kwargs = args[0]
+                args = None
+
+            return str_type(vformat(f_self, args, kwargs))
+
+        return update_wrapper(wrapper, value)
 
     def call(__self, __context, __obj, *args, **kwargs):
         """Call an object from sandboxed code."""
-        fmt = inspect_format_method(__obj)
-        if fmt is not None:
-            return __self.format_string(fmt, args, kwargs, __obj)
 
         # the double prefixes are to avoid double keyword argument
         # errors when proxying the call.
Index: Jinja2-2.10.1/tests/test_security.py
===================================================================
--- Jinja2-2.10.1.orig/tests/test_security.py
+++ Jinja2-2.10.1/tests/test_security.py
@@ -206,3 +206,21 @@ class TestStringFormatMap(object):
         env = SandboxedEnvironment()
         t = env.from_string('{{ ("a{x.foo}b{y}"|safe).format_map({"x":{"foo": 42}, "y":"<foo>"}) }}')
         assert t.render() == 'a42b&lt;foo&gt;'
+
+
+    def test_indirect_call(self):
+        def run(value, arg):
+            return value.run(arg)
+
+        env = SandboxedEnvironment()
+        env.filters["run"] = run
+        t = env.from_string(
+            """{% set
+                ns = namespace(run="{0.__call__.__builtins__[__import__]}".format)
+            %}
+            {{ ns | run(not_here) }}
+            """
+        )
+
+        with pytest.raises(SecurityError):
+            t.render()