mailman/contribs7/mailman-2.1.5.1-CVE-2006-4624.patch

--- mailman-2.1.5.1/Mailman/Utils.py.CVE-2006-4624      2007-05-21 16:23:13.000000000 +0200
+++ mailman-2.1.5.1/Mailman/Utils.py    2007-05-21 16:26:11.000000000 +0200
@@ -50,6 +50,7 @@
 from Mailman import Errors
 from Mailman import Site
 from Mailman.SafeDict import SafeDict
+from Mailman.Logging.Syslog import syslog
 
 try:
     True, False
@@ -216,9 +217,16 @@
 
 
 
+# Patterns which may be used to form malicious path to inject a new
+# line in the mailman error log. (TK: advisory by Moritz Naumann)
+CRNLpat = re.compile(r'[^\x21-\x7e]')
+
 def GetPathPieces(envar='PATH_INFO'):
     path = os.environ.get(envar)
     if path:
+        if CRNLpat.search(path):
+            path = CRNLpat.split(path)[0]
+            syslog('error', 'Warning: Possible malformed path attack.')
         return [p for p in path.split('/') if p]
     return None
 
@@ -497,7 +505,6 @@
                 text = sdict.interpolate(utemplate)
         except (TypeError, ValueError), e:
             # The template is really screwed up
-            from Mailman.Logging.Syslog import syslog
             syslog('error', 'broken template: %s\n%s', filename, e)
             pass
     if raw:
1	slords	1.1	--- mailman-2.1.5.1/Mailman/Utils.py.CVE-2006-4624 2007-05-21 16:23:13.000000000 +0200
2			+++ mailman-2.1.5.1/Mailman/Utils.py 2007-05-21 16:26:11.000000000 +0200
3			@@ -50,6 +50,7 @@
4			from Mailman import Errors
5			from Mailman import Site
6			from Mailman.SafeDict import SafeDict
7			+from Mailman.Logging.Syslog import syslog
8
9			try:
10			True, False
11			@@ -216,9 +217,16 @@
12
13
14
15			+# Patterns which may be used to form malicious path to inject a new
16			+# line in the mailman error log. (TK: advisory by Moritz Naumann)
17			+CRNLpat = re.compile(r'[^\x21-\x7e]')
18			+
19			def GetPathPieces(envar='PATH_INFO'):
20			path = os.environ.get(envar)
21			if path:
22			+ if CRNLpat.search(path):
23			+ path = CRNLpat.split(path)[0]
24			+ syslog('error', 'Warning: Possible malformed path attack.')
25			return [p for p in path.split('/') if p]
26			return None
27
28			@@ -497,7 +505,6 @@
29			text = sdict.interpolate(utemplate)
30			except (TypeError, ValueError), e:
31			# The template is really screwed up
32			- from Mailman.Logging.Syslog import syslog
33			syslog('error', 'broken template: %s\n%s', filename, e)
34			pass
35			if raw: