pygrub: Properly quote results, when returning them to the caller:
authorIan Jackson <ian.jackson@eu.citrix.com>
Thu, 3 Nov 2016 16:37:40 +0000 (16:37 +0000)
committerJan Beulich <jbeulich@suse.com>
Tue, 22 Nov 2016 12:52:09 +0000 (13:52 +0100)
commit27e14d346ed6ff1c3a3cfc479507e62d133e92a9
tree8df86cdc7bfbe796cd20ef720801c39b8ef89a32
parent920edccd41db6cb0145545afa1850edf5e7d098e
pygrub: Properly quote results, when returning them to the caller:

* When the caller wants sexpr output, use `repr()'
  This is what Xend expects.

  The returned S-expressions are now escaped and quoted by Python,
  generally using '...'.  Previously kernel and ramdisk were unquoted
  and args was quoted with "..." but without proper escaping.  This
  change may break toolstacks which do not properly dequote the
  returned S-expressions.

* When the caller wants "simple" output, crash if the delimiter is
  contained in the returned value.

  With --output-format=simple it does not seem like this could ever
  happen, because the bootloader config parsers all take line-based
  input from the various bootloader config files.

  With --output-format=simple0, this can happen if the bootloader
  config file contains nul bytes.

This is CVE-2016-9379 and CVE-2016-9380 / XSA-198.

Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Tested-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
tools/pygrub/src/pygrub