[issue19435] Directory traversal attack for CGIHTTPRequestHandler

2013-10-29 Thread Stéphane Glondu
Changes by Stéphane Glondu : -- nosy: +glondu ___ Python tracker <http://bugs.python.org/issue19435> ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue19948] POSIX semantics of PATH search in execvpe is not respected

2013-12-10 Thread Stéphane Glondu
New submission from Stéphane Glondu: Hello, According to [1], "In the cases where the other members of the exec family of functions would fail and set errno to [ENOEXEC], the execlp() and execvp() functions shall execute a command interpreter and the environment of the executed command

[issue19948] POSIX semantics of PATH search in execvpe is not respected

2013-12-11 Thread Stéphane Glondu
Stéphane Glondu added the comment: > What platform is this on? I'm on Linux (Debian testing). > Looking quickly through posix.execve (which is what I think gets called), it > looks like it just calls C's execve(). Yes, but I'm talking about os.execvp, here. With the

[issue19948] POSIX semantics of PATH search in execvpe is not respected

2013-12-11 Thread Stéphane Glondu
Stéphane Glondu added the comment: > What is the bad idea? Keep looking in subsequent directories in PATH when you > find a candidate for which execve() fails? Sorry, but I beg to differ, and > POSIX is on my side. Sorry, I meant "Stop looking

[issue19948] POSIX semantics of PATH search in execvpe is not respected

2013-12-11 Thread Stéphane Glondu
Stéphane Glondu added the comment: > os.execvp calls os._execvpe which calls posix.execv which calls execv. At > least that's how I think it works. I am not contesting that. This bug is about the "search the command in PATH" part. More precisely, the fact that os.execvp