docs: kernel_feat.py: fix potential command injection
The kernel-feat directive passes its argument straight to the shell.
This is unfortunate and unnecessary.
Let's always use paths relative to $srctree/Documentation/ and use
subprocess.check_call() instead of subprocess.Popen(shell=True).
This also makes the code shorter.
This is analogous to commit 3231dd5862 ("docs: kernel_abi.py: fix
command injection") where we did exactly the same thing for
kernel_abi.py, somehow I completely missed this one.
Link: https://fosstodon.org/@jani/111676532203641247
Reported-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Link: https://lore.kernel.org/r/20240110174758.3680506-1-vegard.nossum@oracle.com
This commit is contained in:
Vegard Nossum
Jonathan Corbet
parent
1f4cac0f74
commit
c48a7c44a1
|
|
@ -1,3 +1,3 @@
|
|||
.. SPDX-License-Identifier: GPL-2.0
|
||||
|
||||
.. kernel-feat:: $srctree/Documentation/features
|
||||
.. kernel-feat:: features
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
.. SPDX-License-Identifier: GPL-2.0
|
||||
|
||||
.. kernel-feat:: $srctree/Documentation/features arc
|
||||
.. kernel-feat:: features arc
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
.. SPDX-License-Identifier: GPL-2.0
|
||||
|
||||
.. kernel-feat:: $srctree/Documentation/features arm
|
||||
.. kernel-feat:: features arm
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
.. SPDX-License-Identifier: GPL-2.0
|
||||
|
||||
.. kernel-feat:: $srctree/Documentation/features arm64
|
||||
.. kernel-feat:: features arm64
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
.. SPDX-License-Identifier: GPL-2.0
|
||||
|
||||
.. kernel-feat:: $srctree/Documentation/features loongarch
|
||||
.. kernel-feat:: features loongarch
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
.. SPDX-License-Identifier: GPL-2.0
|
||||
|
||||
.. kernel-feat:: $srctree/Documentation/features m68k
|
||||
.. kernel-feat:: features m68k
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
.. SPDX-License-Identifier: GPL-2.0
|
||||
|
||||
.. kernel-feat:: $srctree/Documentation/features mips
|
||||
.. kernel-feat:: features mips
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
.. SPDX-License-Identifier: GPL-2.0
|
||||
|
||||
.. kernel-feat:: $srctree/Documentation/features nios2
|
||||
.. kernel-feat:: features nios2
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
.. SPDX-License-Identifier: GPL-2.0
|
||||
|
||||
.. kernel-feat:: $srctree/Documentation/features openrisc
|
||||
.. kernel-feat:: features openrisc
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
.. SPDX-License-Identifier: GPL-2.0
|
||||
|
||||
.. kernel-feat:: $srctree/Documentation/features parisc
|
||||
.. kernel-feat:: features parisc
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
.. SPDX-License-Identifier: GPL-2.0
|
||||
|
||||
.. kernel-feat:: $srctree/Documentation/features powerpc
|
||||
.. kernel-feat:: features powerpc
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
.. SPDX-License-Identifier: GPL-2.0
|
||||
|
||||
.. kernel-feat:: $srctree/Documentation/features riscv
|
||||
.. kernel-feat:: features riscv
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
.. SPDX-License-Identifier: GPL-2.0
|
||||
|
||||
.. kernel-feat:: $srctree/Documentation/features s390
|
||||
.. kernel-feat:: features s390
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
.. SPDX-License-Identifier: GPL-2.0
|
||||
|
||||
.. kernel-feat:: $srctree/Documentation/features sh
|
||||
.. kernel-feat:: features sh
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
.. SPDX-License-Identifier: GPL-2.0
|
||||
|
||||
.. kernel-feat:: $srctree/Documentation/features sparc
|
||||
.. kernel-feat:: features sparc
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
.. SPDX-License-Identifier: GPL-2.0
|
||||
|
||||
.. kernel-feat:: $srctree/Documentation/features x86
|
||||
.. kernel-feat:: features x86
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
.. SPDX-License-Identifier: GPL-2.0
|
||||
|
||||
.. kernel-feat:: $srctree/Documentation/features xtensa
|
||||
.. kernel-feat:: features xtensa
|
||||
|
|
|
|||
|
|
@ -37,8 +37,6 @@ import re
|
|||
import subprocess
|
||||
import sys
|
||||
|
||||
from os import path
|
||||
|
||||
from docutils import nodes, statemachine
|
||||
from docutils.statemachine import ViewList
|
||||
from docutils.parsers.rst import directives, Directive
|
||||
|
|
@ -76,33 +74,26 @@ class KernelFeat(Directive):
|
|||
self.state.document.settings.env.app.warn(message, prefix="")
|
||||
|
||||
def run(self):
|
||||
|
||||
doc = self.state.document
|
||||
if not doc.settings.file_insertion_enabled:
|
||||
raise self.warning("docutils: file insertion disabled")
|
||||
|
||||
env = doc.settings.env
|
||||
cwd = path.dirname(doc.current_source)
|
||||
cmd = "get_feat.pl rest --enable-fname --dir "
|
||||
cmd += self.arguments[0]
|
||||
|
||||
srctree = os.path.abspath(os.environ["srctree"])
|
||||
|
||||
args = [
|
||||
os.path.join(srctree, 'scripts/get_feat.pl'),
|
||||
'rest',
|
||||
'--enable-fname',
|
||||
'--dir',
|
||||
os.path.join(srctree, 'Documentation', self.arguments[0]),
|
||||
]
|
||||
|
||||
if len(self.arguments) > 1:
|
||||
cmd += " --arch " + self.arguments[1]
|
||||
args.extend(['--arch', self.arguments[1]])
|
||||
|
||||
srctree = path.abspath(os.environ["srctree"])
|
||||
|
||||
fname = cmd
|
||||
|
||||
# extend PATH with $(srctree)/scripts
|
||||
path_env = os.pathsep.join([
|
||||
srctree + os.sep + "scripts",
|
||||
os.environ["PATH"]
|
||||
])
|
||||
shell_env = os.environ.copy()
|
||||
shell_env["PATH"] = path_env
|
||||
shell_env["srctree"] = srctree
|
||||
|
||||
lines = self.runCmd(cmd, shell=True, cwd=cwd, env=shell_env)
|
||||
lines = subprocess.check_output(args, cwd=os.path.dirname(doc.current_source)).decode('utf-8')
|
||||
|
||||
line_regex = re.compile(r"^\.\. FILE (\S+)$")
|
||||
|
||||
|
|
@ -121,30 +112,6 @@ class KernelFeat(Directive):
|
|||
nodeList = self.nestedParse(out_lines, fname)
|
||||
return nodeList
|
||||
|
||||
def runCmd(self, cmd, **kwargs):
|
||||
u"""Run command ``cmd`` and return its stdout as unicode."""
|
||||
|
||||
try:
|
||||
proc = subprocess.Popen(
|
||||
cmd
|
||||
, stdout = subprocess.PIPE
|
||||
, stderr = subprocess.PIPE
|
||||
, **kwargs
|
||||
)
|
||||
out, err = proc.communicate()
|
||||
|
||||
out, err = codecs.decode(out, 'utf-8'), codecs.decode(err, 'utf-8')
|
||||
|
||||
if proc.returncode != 0:
|
||||
raise self.severe(
|
||||
u"command '%s' failed with return code %d"
|
||||
% (cmd, proc.returncode)
|
||||
)
|
||||
except OSError as exc:
|
||||
raise self.severe(u"problems with '%s' directive: %s."
|
||||
% (self.name, ErrorString(exc)))
|
||||
return out
|
||||
|
||||
def nestedParse(self, lines, fname):
|
||||
content = ViewList()
|
||||
node = nodes.section()
|
||||
|
|
|
|||
|
|
@ -5,4 +5,4 @@
|
|||
:Original: Documentation/arch/loongarch/features.rst
|
||||
:Translator: Huacai Chen <chenhuacai@loongson.cn>
|
||||
|
||||
.. kernel-feat:: $srctree/Documentation/features loongarch
|
||||
.. kernel-feat:: features loongarch
|
||||
|
|
|
|||
|
|
@ -10,4 +10,4 @@
|
|||
|
||||
.. _cn_features:
|
||||
|
||||
.. kernel-feat:: $srctree/Documentation/features mips
|
||||
.. kernel-feat:: features mips
|
||||
|
|
|
|||
|
|
@ -5,5 +5,5 @@
|
|||
:Original: Documentation/arch/loongarch/features.rst
|
||||
:Translator: Huacai Chen <chenhuacai@loongson.cn>
|
||||
|
||||
.. kernel-feat:: $srctree/Documentation/features loongarch
|
||||
.. kernel-feat:: features loongarch
|
||||
|
||||
|
|
|
|||
|
|
@ -10,5 +10,5 @@
|
|||
|
||||
.. _tw_features:
|
||||
|
||||
.. kernel-feat:: $srctree/Documentation/features mips
|
||||
.. kernel-feat:: features mips
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue