Mercurial > p > roundup > code
annotate roundup/anypy/findargspec.py @ 8356:63390dcfcfe9
bug: fix template use of structure with untrusted data
Looks like an xSS bug with an early version of the template that was
fixed in the code but never in the deployed tracker. It has been a
while since this particular construct has been in the classic template
which is the base for the tracker.
This has been fixed on the deployed tracker as well.
reported by 4bug of ChaMd5 Security Team H1 Group
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Tue, 08 Jul 2025 10:23:09 -0400 |
| parents | c588e64718fc |
| children |
| rev | line source |
|---|---|
|
5269
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
1 ''' Wrapper for getargspec to support other callables and python 3 support |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
2 |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
3 In python 3 just uses getfullargspec which handles regular functions |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
4 and classes with __call__ methods. |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
5 ''' |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
6 |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
7 try: |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
8 # Python 3+ |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
9 from inspect import getfullargspec as getargspec |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
10 findargspec = getargspec |
|
6021
c588e64718fc
flake8 fixes. use except ImportError; use callable() not hasattr(x, '__call__')
John Rouillard <rouilj@ieee.org>
parents:
5269
diff
changeset
|
11 except ImportError: |
|
5269
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
12 # Python 2.5-2.7 modified from https://bugs.python.org/issue20828 |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
13 import inspect |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
14 |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
15 def findargspec(fn): |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
16 if inspect.isfunction(fn) or inspect.ismethod(fn): |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
17 inspectable = fn |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
18 elif inspect.isclass(fn): |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
19 inspectable = fn.__init__ |
|
6021
c588e64718fc
flake8 fixes. use except ImportError; use callable() not hasattr(x, '__call__')
John Rouillard <rouilj@ieee.org>
parents:
5269
diff
changeset
|
20 elif callable(fn): |
|
5269
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
21 inspectable = fn.__call__ |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
22 else: |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
23 inspectable = fn |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
24 |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
25 try: |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
26 return inspect.getargspec(inspectable) |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
27 except TypeError: |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
28 raise |
