mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-04 08:59:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

gh-124651: Quote template strings in venv activation scripts (GH-124712)

Browse source 
This patch properly quotes template strings in `venv` activation
scripts. This mitigates potential command injection.
This commit is contained in:
Y5 2024-10-22 04:48:04 +08:00 • committed by GitHub
parent 44f841f01a
commit d48cc82ed2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
7 changed files with 135 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

10
Lib/venv/scripts/common/activate
View file

@ -41,20 +41,20 @@ case "$(uname)" in
CYGWIN*|MSYS*|MINGW*)
# transform D:\path\to\venv to /d/path/to/venv on MSYS and MINGW
# and to /cygdrive/d/path/to/venv on Cygwin
VIRTUAL_ENV=$(cygpath "__VENV_DIR__")
VIRTUAL_ENV=$(cygpath __VENV_DIR__)
export VIRTUAL_ENV
;;
*)
# use the path as-is
export VIRTUAL_ENV="__VENV_DIR__"
export VIRTUAL_ENV=__VENV_DIR__
;;
esac
_OLD_VIRTUAL_PATH="$PATH"
PATH="$VIRTUAL_ENV/__VENV_BIN_NAME__:$PATH"
PATH="$VIRTUAL_ENV/"__VENV_BIN_NAME__":$PATH"
export PATH
VIRTUAL_ENV_PROMPT="__VENV_PROMPT__"
VIRTUAL_ENV_PROMPT=__VENV_PROMPT__
export VIRTUAL_ENV_PROMPT
# unset PYTHONHOME if set
@ -67,7 +67,7 @@ fi
if [ -z "${VIRTUAL_ENV_DISABLE_PROMPT:-}" ] ; then
_OLD_VIRTUAL_PS1="${PS1:-}"
PS1="(__VENV_PROMPT__) ${PS1:-}"
PS1="("__VENV_PROMPT__") ${PS1:-}"
export PS1
fi

8
Lib/venv/scripts/common/activate.fish
View file

@ -33,11 +33,11 @@ end
# Unset irrelevant variables.
deactivate nondestructive
set -gx VIRTUAL_ENV "__VENV_DIR__"
set -gx VIRTUAL_ENV __VENV_DIR__
set -gx _OLD_VIRTUAL_PATH $PATH
set -gx PATH "$VIRTUAL_ENV/__VENV_BIN_NAME__" $PATH
set -gx VIRTUAL_ENV_PROMPT "__VENV_PROMPT__"
set -gx PATH "$VIRTUAL_ENV/"__VENV_BIN_NAME__ $PATH
set -gx VIRTUAL_ENV_PROMPT __VENV_PROMPT__
# Unset PYTHONHOME if set.
if set -q PYTHONHOME
@ -57,7 +57,7 @@ if test -z "$VIRTUAL_ENV_DISABLE_PROMPT"
set -l old_status $status
# Output the venv prompt; color taken from the blue of the Python logo.
printf "%s(%s)%s " (set_color 4B8BBE) "__VENV_PROMPT__" (set_color normal)
printf "%s(%s)%s " (set_color 4B8BBE) __VENV_PROMPT__ (set_color normal)
# Restore the return status of the previous command.
echo "exit $old_status" | .

6
Lib/venv/scripts/nt/activate.bat
View file

@ -8,7 +8,7 @@ if defined _OLD_CODEPAGE (
"%SystemRoot%\System32\chcp.com" 65001 > nul
)
set VIRTUAL_ENV=__VENV_DIR__
set "VIRTUAL_ENV=__VENV_DIR__"
if not defined PROMPT set PROMPT=$P$G
@ -24,8 +24,8 @@ set PYTHONHOME=
if defined _OLD_VIRTUAL_PATH set PATH=%_OLD_VIRTUAL_PATH%
if not defined _OLD_VIRTUAL_PATH set _OLD_VIRTUAL_PATH=%PATH%
set PATH=%VIRTUAL_ENV%\__VENV_BIN_NAME__;%PATH%
set VIRTUAL_ENV_PROMPT=__VENV_PROMPT__
set "PATH=%VIRTUAL_ENV%\__VENV_BIN_NAME__;%PATH%"
set "VIRTUAL_ENV_PROMPT=__VENV_PROMPT__"
:END
if defined _OLD_CODEPAGE (

8
Lib/venv/scripts/posix/activate.csh
View file

@ -9,17 +9,17 @@ alias deactivate 'test $?_OLD_VIRTUAL_PATH != 0 && setenv PATH "$_OLD_VIRTUAL_PA
# Unset irrelevant variables.
deactivate nondestructive
setenv VIRTUAL_ENV "__VENV_DIR__"
setenv VIRTUAL_ENV __VENV_DIR__
set _OLD_VIRTUAL_PATH="$PATH"
setenv PATH "$VIRTUAL_ENV/__VENV_BIN_NAME__:$PATH"
setenv VIRTUAL_ENV_PROMPT "__VENV_PROMPT__"
setenv PATH "$VIRTUAL_ENV/"__VENV_BIN_NAME__":$PATH"
setenv VIRTUAL_ENV_PROMPT __VENV_PROMPT__
set _OLD_VIRTUAL_PROMPT="$prompt"
if (! "$?VIRTUAL_ENV_DISABLE_PROMPT") then
set prompt = "(__VENV_PROMPT__) $prompt:q"
set prompt = "("__VENV_PROMPT__") $prompt:q"
endif
alias pydoc python -m pydoc