Skip to content

bpo-38945: UU Encoding: Removed newline characters from uu encoding methods #17418

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gvanrossum merged 4 commits into from
Dec 2, 2019
Merged

bpo-38945: UU Encoding: Removed newline characters from uu encoding methods #17418

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
47b888c
Removed newline characters from uu encoding methods
Nov 30, 2019
b79021d
Fixed trailing whitespace
Nov 30, 2019
5ad14ea
Added test for uu encoding overflow
Dec 1, 2019
86915af
📜🤖 Added by blurb_it.
blurb-it[bot] Dec 1, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions Lib/encodings/uu_codec.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,10 @@ def uu_encode(input, errors='strict', filename='<data>', mode=0o666):
read = infile.read
write = outfile.write

# Remove newline chars from filename
filename = filename.replace('\n','\\n')
filename = filename.replace('\r','\\r')

# Encode
write(('begin %o %s\n' % (mode & 0o777, filename)).encode('ascii'))
chunk = read(45)
Expand Down
9 changes: 9 additions & 0 deletions Lib/test/test_uu.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,6 +136,15 @@ def test_garbage_padding(self):
decoded = codecs.decode(encodedtext, "uu_codec")
self.assertEqual(decoded, plaintext)

def test_newlines_escaped(self):
# Test newlines are escaped with uu.encode
inp = io.BytesIO(plaintext)
out = io.BytesIO()
filename = "test.txt\n\roverflow.txt"
safefilename = b"test.txt\\n\\roverflow.txt"
uu.encode(inp, out, filename)
self.assertIn(safefilename, out.getvalue())

class UUStdIOTest(unittest.TestCase):

def setUp(self):
Expand Down
7 changes: 7 additions & 0 deletions Lib/uu.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,13 @@ def encode(in_file, out_file, name=None, mode=None, *, backtick=False):
name = '-'
if mode is None:
mode = 0o666

#
# Remove newline chars from name
#
name = name.replace('\n','\\n')
name = name.replace('\r','\\r')

#
# Write the data
#
Expand Down
1 change: 1 addition & 0 deletions Misc/NEWS.d/next/Security/2019-12-01-22-44-40.bpo-38945.ztmNXc.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Newline characters have been escaped when performing uu encoding to prevent them from overflowing into to content section of the encoded file. This prevents malicious or accidental modification of data during the decoding process.