| Type | Bug | Status | tested | Date | 4-Aug-2009 22:38 |
|---|---|---|---|---|---|
| Version | alpha 76 | Category | Security | Submitted by | BrianH |
| Platform | All | Severity | minor | Priority | high |
| Summary | IMPORT of a module by name can import a module that has a different name |
|---|---|
| Description |
If you import a module by name (IMPORT word!), and the module is not already loaded, then the name is converted to a filename and searched for in the module paths. However, there is no check for whether the script that search finds has the same module name as the name you are searching for. This can be exploited to sneak in an override of a different module than the one you are expecting, which could be a security hole. There needs to be a constraint that a module searched for by name should have the same name that you are searching for, or no name at all. This is a one-line fix. |
| Example code |
| Assigned to | n/a | Fixed in | alpha 81 | Last Update | 1-Nov-2010 20:13 |
|---|
| Comments | |
|---|---|
|
(0001581)
BrianH 3-Sep-2009 07:19 |
Now skips the file if the name doesn't match. If no file matches, an access error is thrown. |
|
(0002677)
BrianH 27-Oct-2010 01:13 |
Note: As of alpha 108 this problem has returned. However, the new module system supports renaming at load time. So we have two choices:
1. Leave it as it is. This will let deliberately unnamed modules continue to reload each time when loaded by name, but will break everything else. 2. Rename if you have to do the library paths lookup. This will make the name that you import consistent, and let you reuse unnamed modules without reloading them. I am leaning towards the second, as it assumes that the end user chose to load by name deliberately. It's a tiny fix too, less than one line. See #1722. |
|
(0002738)
BrianH 1-Nov-2010 20:13 |
Fixed again in alpha 110 - see #1722 for details. Choice 2 above was implemented. |
| Date | User | Field | Action | Change |
|---|---|---|---|---|
| 1-Nov-2010 20:15 | BrianH | Comment : 0002738 | Modified | - |
| 1-Nov-2010 20:13 | BrianH | Status | Modified | problem => tested |
| 1-Nov-2010 20:13 | BrianH | Comment : 0002738 | Added | - |
| 27-Oct-2010 05:46 | BrianH | Comment : 0002677 | Modified | - |
| 27-Oct-2010 01:13 | BrianH | Status | Modified | tested => problem |
| 27-Oct-2010 01:13 | BrianH | Comment : 0002677 | Added | - |
| 3-Sep-2009 07:19 | BrianH | Comment : 0001581 | Added | - |
| 3-Sep-2009 07:17 | BrianH | Fixedin | Modified | => alpha 81 |
| 3-Sep-2009 07:17 | BrianH | Status | Modified | pending => tested |
| 5-Aug-2009 00:19 | BrianH | Description | Modified | - |
| 5-Aug-2009 00:19 | BrianH | Status | Modified | submitted => pending |
| 4-Aug-2009 22:38 | BrianH | Ticket | Added | - |