Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-12-29 17:25:38 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

docs: kernel_feat.py: fix potential command injection

Browse Source 
The kernel-feat directive passes its argument straight to the shell.
This is unfortunate and unnecessary.

Let's always use paths relative to $srctree/Documentation/ and use
subprocess.check_call() instead of subprocess.Popen(shell=True).

This also makes the code shorter.

This is analogous to commit 3231dd5862 ("docs: kernel_abi.py: fix
command injection") where we did exactly the same thing for
kernel_abi.py, somehow I completely missed this one.

Link: https://fosstodon.org/@jani/111676532203641247
Reported-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Link: https://lore.kernel.org/r/20240110174758.3680506-1-vegard.nossum@oracle.com
This commit is contained in:
Vegard Nossum 2024-01-10 18:47:58 +01:00 committed by Jonathan Corbet
parent 1f4cac0f74
commit c48a7c44a1
22 changed files with 33 additions and 66 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Documentation/admin-guide/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features
.. kernel-feat:: features

2
Documentation/arch/arc/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features arc
.. kernel-feat:: features arc

2
Documentation/arch/arm/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features arm
.. kernel-feat:: features arm

2
Documentation/arch/arm64/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features arm64
.. kernel-feat:: features arm64

2
Documentation/arch/loongarch/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features loongarch
.. kernel-feat:: features loongarch

2
Documentation/arch/m68k/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features m68k
.. kernel-feat:: features m68k

2
Documentation/arch/mips/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features mips
.. kernel-feat:: features mips

2
Documentation/arch/nios2/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features nios2
.. kernel-feat:: features nios2

2
Documentation/arch/openrisc/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features openrisc
.. kernel-feat:: features openrisc

2
Documentation/arch/parisc/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features parisc
.. kernel-feat:: features parisc

2
Documentation/arch/powerpc/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features powerpc
.. kernel-feat:: features powerpc

2
Documentation/arch/riscv/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features riscv
.. kernel-feat:: features riscv

2
Documentation/arch/s390/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features s390
.. kernel-feat:: features s390

2
Documentation/arch/sh/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features sh
.. kernel-feat:: features sh

2
Documentation/arch/sparc/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features sparc
.. kernel-feat:: features sparc

2
Documentation/arch/x86/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features x86
.. kernel-feat:: features x86

2
Documentation/arch/xtensa/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features xtensa
.. kernel-feat:: features xtensa

57
Documentation/sphinx/kernel_feat.py
View File

@ -37,8 +37,6 @@ import re
import subprocess
import sys
from os import path
from docutils import nodes, statemachine
from docutils.statemachine import ViewList
from docutils.parsers.rst import directives, Directive
@ -76,33 +74,26 @@ class KernelFeat(Directive):
self.state.document.settings.env.app.warn(message, prefix="")
def run(self):
doc = self.state.document
if not doc.settings.file_insertion_enabled:
raise self.warning("docutils: file insertion disabled")
env = doc.settings.env
cwd = path.dirname(doc.current_source)
cmd = "get_feat.pl rest --enable-fname --dir "
cmd += self.arguments[0]
srctree = os.path.abspath(os.environ["srctree"])
args = [
os.path.join(srctree, 'scripts/get_feat.pl'),
'rest',
'--enable-fname',
'--dir',
os.path.join(srctree, 'Documentation', self.arguments[0]),
]
if len(self.arguments) > 1:
cmd += " --arch " + self.arguments[1]
args.extend(['--arch', self.arguments[1]])
srctree = path.abspath(os.environ["srctree"])
fname = cmd
# extend PATH with $(srctree)/scripts
path_env = os.pathsep.join([
srctree + os.sep + "scripts",
os.environ["PATH"]
])
shell_env = os.environ.copy()
shell_env["PATH"] = path_env
shell_env["srctree"] = srctree
lines = self.runCmd(cmd, shell=True, cwd=cwd, env=shell_env)
lines = subprocess.check_output(args, cwd=os.path.dirname(doc.current_source)).decode('utf-8')
line_regex = re.compile(r"^\.\. FILE (\S+)$")
@ -121,30 +112,6 @@ class KernelFeat(Directive):
nodeList = self.nestedParse(out_lines, fname)
return nodeList
def runCmd(self, cmd, **kwargs):
u"""Run command ``cmd`` and return its stdout as unicode."""
try:
proc = subprocess.Popen(
cmd
, stdout = subprocess.PIPE
, stderr = subprocess.PIPE
, **kwargs
)
out, err = proc.communicate()
out, err = codecs.decode(out, 'utf-8'), codecs.decode(err, 'utf-8')
if proc.returncode != 0:
raise self.severe(
u"command '%s' failed with return code %d"
% (cmd, proc.returncode)
)
except OSError as exc:
raise self.severe(u"problems with '%s' directive: %s."
% (self.name, ErrorString(exc)))
return out
def nestedParse(self, lines, fname):
content = ViewList()
node = nodes.section()

2
Documentation/translations/zh_CN/arch/loongarch/features.rst
View File

@ -5,4 +5,4 @@
:Original: Documentation/arch/loongarch/features.rst
:Translator: Huacai Chen <chenhuacai@loongson.cn>
.. kernel-feat:: $srctree/Documentation/features loongarch
.. kernel-feat:: features loongarch

2
Documentation/translations/zh_CN/arch/mips/features.rst
View File

@ -10,4 +10,4 @@
.. _cn_features:
.. kernel-feat:: $srctree/Documentation/features mips
.. kernel-feat:: features mips

2
Documentation/translations/zh_TW/arch/loongarch/features.rst
View File

@ -5,5 +5,5 @@
:Original: Documentation/arch/loongarch/features.rst
:Translator: Huacai Chen <chenhuacai@loongson.cn>
.. kernel-feat:: $srctree/Documentation/features loongarch
.. kernel-feat:: features loongarch

2
Documentation/translations/zh_TW/arch/mips/features.rst
View File

@ -10,5 +10,5 @@
.. _tw_features:
.. kernel-feat:: $srctree/Documentation/features mips
.. kernel-feat:: features mips