annotate roundup/dist/command/install_lib.py @ 5924:b40059d7036f
issue2550925 strip HTTP_PROXY environment variable
if deployed as CGI and client sends an http PROXY
header, the tainted HTTP_PROXY environment variable is created. It
can affect calls using requests package or curl. A roundup admin
would have to write detectors/extensions that use these mechanisms.
Not exploitable in default config.
See: https://httpoxy.org/
| author |
John Rouillard <rouilj@ieee.org> |
| date |
Sun, 13 Oct 2019 17:45:06 -0400 |
| parents |
85dfe17c182e |
| children |
42bf0a707763 |
| rev |
line source |
4516
Bernhard Reiter <Bernhard.Reiter@intevation.de>
parents:
diff
changeset
|
1 from roundup.dist.command.build import build_message_files, check_manifest
|
Bernhard Reiter <Bernhard.Reiter@intevation.de>
parents:
diff
changeset
|
2 from distutils.command.install_lib import install_lib as base
|
Bernhard Reiter <Bernhard.Reiter@intevation.de>
parents:
diff
changeset
|
3
|
Bernhard Reiter <Bernhard.Reiter@intevation.de>
parents:
diff
changeset
|
4 class install_lib(base):
|
Bernhard Reiter <Bernhard.Reiter@intevation.de>
parents:
diff
changeset
|
5
|
Bernhard Reiter <Bernhard.Reiter@intevation.de>
parents:
diff
changeset
|
6 def run(self):
|
Bernhard Reiter <Bernhard.Reiter@intevation.de>
parents:
diff
changeset
|
7 check_manifest()
|
Bernhard Reiter <Bernhard.Reiter@intevation.de>
parents:
diff
changeset
|
8 build_message_files(self)
|
Bernhard Reiter <Bernhard.Reiter@intevation.de>
parents:
diff
changeset
|
9 base.run(self)
|
