diff -Nru jinja2-2.8/debian/changelog jinja2-2.8/debian/changelog --- jinja2-2.8/debian/changelog 2015-08-01 12:29:32.000000000 +0000 +++ jinja2-2.8/debian/changelog 2019-05-14 17:37:54.000000000 +0000 @@ -1,3 +1,18 @@ +jinja2 (2.8-1ubuntu0.1) xenial-security; urgency=medium + + * SECURITY UPDATE: sandbox escape via str.format + - debian/patches/CVE-2016-10745-1.patch: support sandboxing in format + expressions in jinja2/nodes.py, jinja2/sandbox.py. + - debian/patches/CVE-2016-10745-2.patch: fix a name error for an + uncommon attribute access in the sandbox in jinja2/sandbox.py. + - CVE-2016-10745 + * SECURITY UPDATE: sandbox escape via str.format_map + - debian/patches/CVE-2019-10906.patch: properly sandbox format_map in + jinja2/sandbox.py. + - CVE-2019-10906 + + -- Marc Deslauriers Tue, 14 May 2019 13:35:38 -0400 + jinja2 (2.8-1) unstable; urgency=medium * New upstream release diff -Nru jinja2-2.8/debian/control jinja2-2.8/debian/control --- jinja2-2.8/debian/control 2015-08-01 12:29:04.000000000 +0000 +++ jinja2-2.8/debian/control 2019-05-14 17:38:09.000000000 +0000 @@ -1,7 +1,8 @@ Source: jinja2 Section: python Priority: optional -Maintainer: Piotr Ożarowski +Maintainer: Ubuntu Developers +XSBC-Original-Maintainer: Piotr Ożarowski Uploaders: Debian Python Modules Team Build-Depends: debhelper (>= 9), dh-python, python-all (>= 2.6.6-3), python3-all, diff -Nru jinja2-2.8/debian/patches/CVE-2016-10745-1.patch jinja2-2.8/debian/patches/CVE-2016-10745-1.patch --- jinja2-2.8/debian/patches/CVE-2016-10745-1.patch 1970-01-01 00:00:00.000000000 +0000 +++ jinja2-2.8/debian/patches/CVE-2016-10745-1.patch 2019-05-14 17:33:47.000000000 +0000 @@ -0,0 +1,199 @@ +Backport of: + +From 9b53045c34e61013dc8f09b7e52a555fa16bed16 Mon Sep 17 00:00:00 2001 +From: Armin Ronacher +Date: Thu, 29 Dec 2016 14:13:38 +0100 +Subject: [PATCH] SECURITY: support sandboxing in format expressions + +--- + jinja2/nodes.py | 2 +- + jinja2/sandbox.py | 119 +++++++++++++++++++++++++++++++++++++++-- + tests/test_security.py | 27 +++++++++- + 3 files changed, 143 insertions(+), 5 deletions(-) + +Index: jinja2-2.8/jinja2/nodes.py +=================================================================== +--- jinja2-2.8.orig/jinja2/nodes.py 2019-05-14 13:33:38.973089545 -0400 ++++ jinja2-2.8/jinja2/nodes.py 2019-05-14 13:33:38.965089508 -0400 +@@ -604,7 +604,7 @@ class Call(Expr): + + def as_const(self, eval_ctx=None): + eval_ctx = get_eval_context(self, eval_ctx) +- if eval_ctx.volatile: ++ if eval_ctx.volatile or eval_ctx.environment.sandboxed: + raise Impossible() + obj = self.node.as_const(eval_ctx) + +Index: jinja2-2.8/jinja2/sandbox.py +=================================================================== +--- jinja2-2.8.orig/jinja2/sandbox.py 2019-05-14 13:33:38.973089545 -0400 ++++ jinja2-2.8/jinja2/sandbox.py 2019-05-14 13:33:38.965089508 -0400 +@@ -14,9 +14,17 @@ + """ + import types + import operator ++from collections import Mapping + from jinja2.environment import Environment + from jinja2.exceptions import SecurityError +-from jinja2._compat import string_types, PY2 ++from jinja2._compat import string_types, text_type, PY2 ++from jinja2.utils import Markup ++ ++has_format = False ++if hasattr(text_type, 'format'): ++ from markupsafe import EscapeFormatter ++ from string import Formatter ++ has_format = True + + + #: maximum number of items a range may produce +@@ -38,6 +46,12 @@ UNSAFE_METHOD_ATTRIBUTES = set(['im_clas + #: unsafe generator attirbutes. + UNSAFE_GENERATOR_ATTRIBUTES = set(['gi_frame', 'gi_code']) + ++#: unsafe attributes on coroutines ++UNSAFE_COROUTINE_ATTRIBUTES = set(['cr_frame', 'cr_code']) ++ ++#: unsafe attributes on async generators ++UNSAFE_ASYNC_GENERATOR_ATTRIBUTES = set(['ag_code', 'ag_frame']) ++ + import warnings + + # make sure we don't warn in python 2.6 about stuff we don't care about +@@ -94,6 +108,49 @@ _mutable_spec = ( + ) + + ++class _MagicFormatMapping(Mapping): ++ """This class implements a dummy wrapper to fix a bug in the Python ++ standard library for string formatting. ++ ++ See http://bugs.python.org/issue13598 for information about why ++ this is necessary. ++ """ ++ ++ def __init__(self, args, kwargs): ++ self._args = args ++ self._kwargs = kwargs ++ self._last_index = 0 ++ ++ def __getitem__(self, key): ++ if key == '': ++ idx = self._last_index ++ self._last_index += 1 ++ try: ++ return self._args[idx] ++ except LookupError: ++ pass ++ key = str(idx) ++ return self._kwargs[key] ++ ++ def __iter__(self): ++ return iter(self._kwargs) ++ ++ def __len__(self): ++ return len(self._kwargs) ++ ++ ++def inspect_format_method(callable): ++ if not has_format: ++ return None ++ if not isinstance(callable, (types.MethodType, ++ types.BuiltinMethodType)) or \ ++ callable.__name__ != 'format': ++ return None ++ obj = callable.__self__ ++ if isinstance(obj, string_types): ++ return obj ++ ++ + def safe_range(*args): + """A range that can't generate ranges with a length of more than + MAX_RANGE items. +@@ -145,6 +202,12 @@ def is_internal_attribute(obj, attr): + elif isinstance(obj, types.GeneratorType): + if attr in UNSAFE_GENERATOR_ATTRIBUTES: + return True ++ elif hasattr(types, 'CoroutineType') and isinstance(obj, types.CoroutineType): ++ if attr in UNSAFE_COROUTINE_ATTRIBUTES: ++ return True ++ elif hasattr(types, 'AsyncGeneratorType') and isinstance(obj, types.AsyncGeneratorType): ++ if attri in UNSAFE_ASYNC_GENERATOR_ATTRIBUTES: ++ return True + return attr.startswith('__') + + +@@ -183,8 +246,8 @@ class SandboxedEnvironment(Environment): + attributes or functions are safe to access. + + If the template tries to access insecure code a :exc:`SecurityError` is +- raised. However also other exceptions may occour during the rendering so +- the caller has to ensure that all exceptions are catched. ++ raised. However also other exceptions may occur during the rendering so ++ the caller has to ensure that all exceptions are caught. + """ + sandboxed = True + +@@ -346,8 +409,24 @@ class SandboxedEnvironment(Environment): + obj.__class__.__name__ + ), name=attribute, obj=obj, exc=SecurityError) + ++ def format_string(self, s, args, kwargs): ++ """If a format call is detected, then this is routed through this ++ method so that our safety sandbox can be used for it. ++ """ ++ if isinstance(s, Markup): ++ formatter = SandboxedEscapeFormatter(self, s.escape) ++ else: ++ formatter = SandboxedFormatter(self) ++ kwargs = _MagicFormatMapping(args, kwargs) ++ rv = formatter.vformat(s, args, kwargs) ++ return type(s)(rv) ++ + def call(__self, __context, __obj, *args, **kwargs): + """Call an object from sandboxed code.""" ++ fmt = inspect_format_method(__obj) ++ if fmt is not None: ++ return __self.format_string(fmt, args, kwargs) ++ + # the double prefixes are to avoid double keyword argument + # errors when proxying the call. + if not __self.is_safe_callable(__obj): +@@ -365,3 +444,37 @@ class ImmutableSandboxedEnvironment(Sand + if not SandboxedEnvironment.is_safe_attribute(self, obj, attr, value): + return False + return not modifies_known_mutable(obj, attr) ++ ++ ++if has_format: ++ # This really is not a public API apparenlty. ++ try: ++ from _string import formatter_field_name_split ++ except ImportError: ++ def formatter_field_name_split(field_name): ++ return field_name._formatter_field_name_split() ++ ++ class SandboxedFormatterMixin(object): ++ ++ def __init__(self, env): ++ self._env = env ++ ++ def get_field(self, field_name, args, kwargs): ++ first, rest = formatter_field_name_split(field_name) ++ obj = self.get_value(first, args, kwargs) ++ for is_attr, i in rest: ++ if is_attr: ++ obj = self._env.getattr(obj, i) ++ else: ++ obj = self._env.getitem(obj, i) ++ return obj, first ++ ++ class SandboxedFormatter(SandboxedFormatterMixin, Formatter): ++ def __init__(self, env): ++ SandboxedFormatterMixin.__init__(self, env) ++ Formatter.__init__(self) ++ ++ class SandboxedEscapeFormatter(SandboxedFormatterMixin, EscapeFormatter): ++ def __init__(self, env, escape): ++ SandboxedFormatterMixin.__init__(self, env) ++ EscapeFormatter.__init__(self, escape) diff -Nru jinja2-2.8/debian/patches/CVE-2016-10745-2.patch jinja2-2.8/debian/patches/CVE-2016-10745-2.patch --- jinja2-2.8/debian/patches/CVE-2016-10745-2.patch 1970-01-01 00:00:00.000000000 +0000 +++ jinja2-2.8/debian/patches/CVE-2016-10745-2.patch 2019-05-14 17:36:48.000000000 +0000 @@ -0,0 +1,45 @@ +Backport of: + +From 74bd64e56387f5b2931040dc7235a3509cde1611 Mon Sep 17 00:00:00 2001 +From: Armin Ronacher +Date: Thu, 29 Dec 2016 16:01:35 +0100 +Subject: [PATCH] Fixed a name error for an uncommon attribute access in the + sandbox + +--- + CHANGES | 8 ++++++++ + jinja2/sandbox.py | 2 +- + 2 files changed, 9 insertions(+), 1 deletion(-) + +#diff --git a/CHANGES b/CHANGES +#index 29a773b9..01130549 100644 +#--- a/CHANGES +#+++ b/CHANGES +#@@ -1,6 +1,14 @@ +# Jinja2 Changelog +# ================ +# +#+Version 2.8.2 +#+------------- +#+ +#+(bugfix release, unreleased) +#+ +#+- Fixed a runtime error in the sandbox when attributes of async generators +#+ were accessed. +#+ +# Version 2.8.1 +# ------------- +# +diff --git a/jinja2/sandbox.py b/jinja2/sandbox.py +index c035ddea..549c4276 100644 +--- a/jinja2/sandbox.py ++++ b/jinja2/sandbox.py +@@ -206,7 +206,7 @@ def is_internal_attribute(obj, attr): + if attr in UNSAFE_COROUTINE_ATTRIBUTES: + return True + elif hasattr(types, 'AsyncGeneratorType') and isinstance(obj, types.AsyncGeneratorType): +- if attri in UNSAFE_ASYNC_GENERATOR_ATTRIBUTES: ++ if attr in UNSAFE_ASYNC_GENERATOR_ATTRIBUTES: + return True + return attr.startswith('__') + diff -Nru jinja2-2.8/debian/patches/CVE-2019-10906.patch jinja2-2.8/debian/patches/CVE-2019-10906.patch --- jinja2-2.8/debian/patches/CVE-2019-10906.patch 1970-01-01 00:00:00.000000000 +0000 +++ jinja2-2.8/debian/patches/CVE-2019-10906.patch 2019-05-14 17:36:43.000000000 +0000 @@ -0,0 +1,61 @@ +Backport of: + +From a2a6c930bcca591a25d2b316fcfd2d6793897b26 Mon Sep 17 00:00:00 2001 +From: Armin Ronacher +Date: Sat, 6 Apr 2019 10:50:47 -0700 +Subject: [PATCH] sandbox str.format_map + +--- + jinja2/sandbox.py | 17 ++++++++++++++--- + tests/test_security.py | 19 +++++++++++++++++++ + 2 files changed, 33 insertions(+), 3 deletions(-) + +Index: jinja2-2.8/jinja2/sandbox.py +=================================================================== +--- jinja2-2.8.orig/jinja2/sandbox.py 2019-05-14 13:34:35.657348013 -0400 ++++ jinja2-2.8/jinja2/sandbox.py 2019-05-14 13:34:35.657348013 -0400 +@@ -144,7 +144,7 @@ def inspect_format_method(callable): + return None + if not isinstance(callable, (types.MethodType, + types.BuiltinMethodType)) or \ +- callable.__name__ != 'format': ++ callable.__name__ not in ('format', 'format_map'): + return None + obj = callable.__self__ + if isinstance(obj, string_types): +@@ -409,7 +409,7 @@ class SandboxedEnvironment(Environment): + obj.__class__.__name__ + ), name=attribute, obj=obj, exc=SecurityError) + +- def format_string(self, s, args, kwargs): ++ def format_string(self, s, args, kwargs, format_func=None): + """If a format call is detected, then this is routed through this + method so that our safety sandbox can be used for it. + """ +@@ -417,6 +417,17 @@ class SandboxedEnvironment(Environment): + formatter = SandboxedEscapeFormatter(self, s.escape) + else: + formatter = SandboxedFormatter(self) ++ ++ if format_func is not None and format_func.__name__ == 'format_map': ++ if len(args) != 1 or kwargs: ++ raise TypeError( ++ 'format_map() takes exactly one argument %d given' ++ % (len(args) + (kwargs is not None)) ++ ) ++ ++ kwargs = args[0] ++ args = None ++ + kwargs = _MagicFormatMapping(args, kwargs) + rv = formatter.vformat(s, args, kwargs) + return type(s)(rv) +@@ -425,7 +436,7 @@ class SandboxedEnvironment(Environment): + """Call an object from sandboxed code.""" + fmt = inspect_format_method(__obj) + if fmt is not None: +- return __self.format_string(fmt, args, kwargs) ++ return __self.format_string(fmt, args, kwargs, __obj) + + # the double prefixes are to avoid double keyword argument + # errors when proxying the call. diff -Nru jinja2-2.8/debian/patches/series jinja2-2.8/debian/patches/series --- jinja2-2.8/debian/patches/series 1970-01-01 00:00:00.000000000 +0000 +++ jinja2-2.8/debian/patches/series 2019-05-14 17:34:29.000000000 +0000 @@ -0,0 +1,3 @@ +CVE-2016-10745-1.patch +CVE-2016-10745-2.patch +CVE-2019-10906.patch