Repository navigation
Directory traversal in uu module / uu.decode #99889
Description
Activity
- added 5 commits that reference this issue
on May 9, 2023 - added 3 commits that reference this issue
on May 9, 2023 - added a commit that references this issue
on May 27, 2023 The permission on the uu.py file is changed from 755 to 644. Is this a misoperation? Why change this permission?
@alittlesir Could you file a new issue, please? Here is a chance that core developers do not track the solved ones.
Bug report
The function uu.decode is vulnerable to trivial directory traversal if no output filename is given. An uu-encoded file with a path starting with a repetition of ../../ or a / allows writing a file to an arbitrary location on the filesystem.
I reported this to security@python.org and was asked to report it publicly as the function is rarely used and removal is planned anyway for Python 3.13.
Your environment
CPython versions tested on: 3.10.8
Operating system and architecture: Linux
example files
Case 1:
Case 2:
Linked PRs