ffi: No interior NULs (part 1) (#8245) · RustPython/RustPython@419a0b2 · GitHub
Skip to content

Commit 419a0b2

Browse files
ffi: No interior NULs (part 1) (#8245)
* ffi: No interior NULs (part 1) Interior NULs is a security hazard for C-style strings. A NUL byte truncates a string which can lead the caller and callee to see two different strings. It can cause path traversal attacks where a path in Python looks complete but it is interpreted differently through FFI. RustPython needs to handle this for some of its C-API as well as raw libc or Windows calls. Both Rust's standard library as well as Rustix handle interior NULs for us with CStrings, so this mostly affects a handful of Windows functions or areas where we have raw bytes that weren't checked by CString. Finally, this PR is non-exhaustive. I will have to rely heavily on CodeRabbit to help lint it to ensure that interior NUL checks are only introduced for FFI and not outside of it. Most of RustPython seems to handle interior NULs already due to CString as well as WideCString. **Sources:** * https://owasp.org/www-community/attacks/Embedding_Null_Code * python/cpython#11656 * rename null_terminated_bytes --------- Co-authored-by: Jeong, YunWon <69878+youknowone@users.noreply.github.com> Co-authored-by: Jeong, YunWon <jeong@youknowone.org>
1 parent d8bb7bb commit 419a0b2

20 files changed

Lines changed: 501 additions & 529 deletions

File tree

crates/host_env/src/ctypes.rs

Lines changed: 11 additions & 7 deletions

crates/host_env/src/fileutils.rs

Lines changed: 11 additions & 18 deletions

0 commit comments

Comments
 (0)