➜

This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Author yao zhihua
Recipients ned.deily, orsenthil, yao zhihua
Date 2018-03-10.14:20:18
SpamBayes Score -1.0
Marked as misclassified Yes
Message-id <1520691619.05.0.467229070634.issue32993@psf.upfronthosting.co.za>
In-reply-to
Content 
Here about webbrowser vulnerability.
https://bugs.python.org/issue32367

You could execute command with file protocols in python 2.7.10.

poc :
import webbrowser, os
filename = "/bin/ls"
webbrowser.open(os.path.realpath(filename))

If python has fixed this vulnerability,why can I access file:///etc/passwd? But I can't access /etc/shadow.Is this it fixed incomplete?
History
Date User Action Args
2018-03-10 14:20:19yao zhihuasetrecipients: + yao zhihua, orsenthil, ned.deily
2018-03-10 14:20:19yao zhihuasetmessageid: <1520691619.05.0.467229070634.issue32993@psf.upfronthosting.co.za>
2018-03-10 14:20:19yao zhihualinkissue32993 messages
2018-03-10 14:20:18yao zhihuacreate