bpo-42988: Remove the pydoc getfile feature (GH-25015)
authorMiss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Mon, 29 Mar 2021 13:08:00 +0000 (06:08 -0700)
committerAdrian Bunk <bunk@debian.org>
Sun, 1 Dec 2024 12:12:57 +0000 (14:12 +0200)
commitb502c20a086306f8ea8cf564fb69a67c73905ae8
tree4315611ef669f250ce8801b95520a9761534f1fb
parentc8f0eebc238e1b126811992e8076d020d5589fab
bpo-42988: Remove the pydoc getfile feature (GH-25015)

CVE-2021-3426: Remove the "getfile" feature of the pydoc module which
could be abused to read arbitrary files on the disk (directory
traversal vulnerability). Moreover, even source code of Python
modules can contain sensitive data like passwords. Vulnerability
reported by David Schwörer.
(cherry picked from commit 9b999479c0022edfc9835a8a1f06e046f3881048)

Co-authored-by: Victor Stinner <vstinner@python.org>
Gbp-Pq: Name 0003-bpo-42988-Remove-the-pydoc-getfile-feature-GH-25015.patch
Lib/pydoc.py
Lib/test/test_pydoc.py