tag 503632 patch thanks On Mon, Oct 27, 2008 at 12:37:12AM -0400, James Vega wrote: > Blender's BPY_interface calls PySys_SetArgv such that Python prepends > sys.path with an empty string. This allows the possibility to run > arbitrary code on the user's system if there is a python file in > Blender's working directory named the same as one that Blender's python > scripts try to import.
Attached patch sanitizes Python's path. -- James GPG Key: 1024D/61326D40 2003-09-02 James Vega <[EMAIL PROTECTED]>
diff -u blender-2.46+dfsg/debian/changelog blender-2.46+dfsg/debian/changelog
--- blender-2.46+dfsg/debian/changelog
+++ blender-2.46+dfsg/debian/changelog
@@ -1,3 +1,12 @@
+blender (2.46+dfsg-4.1) UNRELEASED; urgency=high
+
+ * Non-maintainer upload.
+ * Remove empty elements from sys.path to prevent loading arbitrary Python
+ scripts from the current working directory. (Closes: #503632)
+ - debian/patches/01_sanitize_sys.path
+
+ -- James Vega <[EMAIL PROTECTED]> Wed, 22 Oct 2008 22:48:58 -0400
+
blender (2.46+dfsg-4) unstable; urgency=low
* Fix python syntax warning in import_dxf.py, which led to nasty output
diff -u blender-2.46+dfsg/debian/patches/series blender-2.46+dfsg/debian/patches/series
--- blender-2.46+dfsg/debian/patches/series
+++ blender-2.46+dfsg/debian/patches/series
@@ -1,4 +1,5 @@
#10_gnukfreebsd_support
+01_sanitize_sys.path
02_tmp_in_HOME
10_use_systemwide_ftgl
20_fix_ftbfs_with_latest_ftgl
only in patch2:
unchanged:
--- blender-2.46+dfsg.orig/debian/patches/01_sanitize_sys.path
+++ blender-2.46+dfsg/debian/patches/01_sanitize_sys.path
@@ -0,0 +1,13 @@
+--- a/source/blender/python/BPY_interface.c
++++ b/source/blender/python/BPY_interface.c
+@@ -225,6 +225,10 @@
+ //Start the interpreter
+ Py_Initialize( );
+ PySys_SetArgv( argc_copy, argv_copy );
++ /* Sanitize sys.path to prevent relative imports loading modules in
++ * the current working directory
++ */
++ PyRun_SimpleString("import sys; sys.path = filter(None, sys.path)");
+
+ /* Initialize thread support (also acquires lock) */
+ PyEval_InitThreads();
signature.asc
Description: Digital signature
