bpo-42988: Remove the pydoc getfile feature (GH-25015)
authorMiss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Mon, 29 Mar 2021 13:08:00 +0000 (06:08 -0700)
committerSean Whitton <spwhitton@spwhitton.name>
Thu, 20 Mar 2025 02:07:39 +0000 (10:07 +0800)
commit27d63ba79116ffd8fc951de398a56edef4c98c21
treeb9e6e4c4aabb1b77f2907c209483c426d7d46045
parent6243150e968da90d1968efcf1ac41056480d595f
bpo-42988: Remove the pydoc getfile feature (GH-25015)

CVE-2021-3426: Remove the "getfile" feature of the pydoc module which
could be abused to read arbitrary files on the disk (directory
traversal vulnerability). Moreover, even source code of Python
modules can contain sensitive data like passwords. Vulnerability
reported by David Schwörer.
(cherry picked from commit 9b999479c0022edfc9835a8a1f06e046f3881048)

Co-authored-by: Victor Stinner <vstinner@python.org>
Gbp-Pq: Name 0003-bpo-42988-Remove-the-pydoc-getfile-feature-GH-25015.patch
Lib/pydoc.py
Lib/test/test_pydoc.py