Просмотр исходного кода

qubes: validate if property value consists of ASCII only earlier

Do this for all standard property types - even if other types do
additional validation, do not expose them to non-ASCII characters.

QubesOS/qubes-issues#2622
Marek Marczykowski-Górecki 6 лет назад
Родитель
Сommit
919841635b
1 измененных файлов с 5 добавлено и 4 удалено
  1. 5 4
      qubes/__init__.py

+ 5 - 4
qubes/__init__.py

@@ -331,11 +331,12 @@ class property(object):  # pylint: disable=redefined-builtin,invalid-name
         # do not treat type='str' as sufficient validation
         if self.type is not None and self.type is not str:
             # assume specific type will preform enough validation
+            try:
+                untrusted_newvalue = untrusted_newvalue.decode('ascii',
+                    errors='strict')
+            except UnicodeDecodeError:
+                raise qubes.exc.QubesValueError
             if self.type is bool:
-                try:
-                    untrusted_newvalue = untrusted_newvalue.decode('ascii')
-                except UnicodeDecodeError:
-                    raise qubes.exc.QubesValueError
                 return self.bool(None, None, untrusted_newvalue)
             else:
                 try: