tree 826f493233cb941523b4f59c923f07300a9d9553
parent 2f463cf5b0e98a52bc20e348d1e69761bf263b86
author Riccardo Schirone <ret2libc@users.noreply.github.com> 1584468595 +0100
committer GitHub <noreply@github.com> 1584468595 +0100
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsBcBAABCAAQBQJecRJzCRBK7hj4Ov3rIwAAdHIIAE352zIYMnBLIPhVBWEo4CPk
 aPBnyz+xQ41caKJFWIzZZpyvRVnirxAsOEVUJnjhP8pZNVwHRfNEPeiH/ecGVjmW
 b8Fs4mGbDC6VMdOsc53/V1hW84fXMtd43wfg1l1NBN35X57RdLZ8O/BkEVpUzEel
 NVZ8uYB+c2C31DKpSe5eDCPr7HAVI5Ebwyj6aLW1hvfrYEgfquIfiY7epspgzkaa
 KidnF/wlmbva8Fr5mdj9b5GPDMOM4q/hCHvYEySs1161VzhXgWTdMU8lrzP0X/C6
 RO9IpUXLHbTqpmKytt37jV8SW6c3P2xnnoZc97DK+nCfNGgDjJZ2k5rpPccRZiE=
 =hiK8
 -----END PGP SIGNATURE-----
 

Prevents arbitrary code execution during python/object/new constructor (#386)

* Prevents arbitrary code execution during python/object/new constructor

In FullLoader python/object/new constructor, implemented by
construct_python_object_apply, has support for setting the state of a
deserialized instance through the set_python_instance_state method.
After setting the state, some operations are performed on the instance
to complete its initialization, however it is possible for an attacker
to set the instance' state in such a way that arbitrary code is executed
by the FullLoader.

This patch tries to block such attacks in FullLoader by preventing
set_python_instance_state from setting arbitrary properties. It
implements a blacklist that includes `extend` method (called by
construct_python_object_apply) and all special methods (e.g. __set__,
__setitem__, etc.).

Users who need special attributes being set in the state of a
deserialized object can still do it through the UnsafeLoader, which
however should not be used on untrusted input. Additionally, they can
subclass FullLoader and redefine `get_state_keys_blacklist()` to
extend/replace the list of blacklisted keys, passing the subclassed
loader to yaml.load.

* Make sure python/object/new constructor does not set some properties

* Add test to show how to subclass FullLoader with new blacklist