{{ message }}
Commit 419a0b2
ffi: No interior NULs (part 1) (#8245)
* ffi: No interior NULs (part 1)
Interior NULs is a security hazard for C-style strings. A NUL byte
truncates a string which can lead the caller and callee to see two
different strings. It can cause path traversal attacks where a path in
Python looks complete but it is interpreted differently through FFI.
RustPython needs to handle this for some of its C-API as well as raw
libc or Windows calls. Both Rust's standard library as well as Rustix
handle interior NULs for us with CStrings, so this mostly affects
a handful of Windows functions or areas where we have raw bytes that
weren't checked by CString.
Finally, this PR is non-exhaustive. I will have to rely heavily on
CodeRabbit to help lint it to ensure that interior NUL checks are only
introduced for FFI and not outside of it. Most of RustPython seems to
handle interior NULs already due to CString as well as WideCString.
**Sources:**
* https://owasp.org/www-community/attacks/Embedding_Null_Code
* python/cpython#11656
* rename null_terminated_bytes
---------
Co-authored-by: Jeong, YunWon <69878+youknowone@users.noreply.github.com>
Co-authored-by: Jeong, YunWon <jeong@youknowone.org>1 parent d8bb7bb commit 419a0b2
20 files changed
Lines changed: 501 additions & 529 deletions
File tree
- crates
- host_env/src
- stdlib/src
- vm/src
- stdlib
- _ctypes

0 commit comments