[issue13301] the script Tools/i18n/msgfmt.py allows arbitrary code execution via po files

2011-10-31 Thread David Jean Louis
David Jean Louis added the comment: Hmm, I missed your previous message, indeed, unescaping is not handled by this patch, sorry about that. Here's how it is handled in polib: https://bitbucket.org/izi/polib/src/dbafdc621bf4/polib.py#c

[issue13301] the script Tools/i18n/msgfmt.py allows arbitrary code execution via po files

2011-10-31 Thread David Jean Louis
David Jean Louis added the comment: I'm adding an updated patch that also handles unescaped double quote at the beginning of the string. -- versions: +Python 2.6, Python 3.1, Python 3.4 Added file: http://bugs.python.org/file23567/msgfmt.py.diff.update1

[issue13301] the script Tools/i18n/msgfmt.py allows arbitrary code execution via po files

2011-10-31 Thread David Jean Louis
New submission from David Jean Louis : Hi, I'm the author of the polib python module, incidentally (after a bug report in polib: https://bitbucket.org/izi/polib/issue/27/polib-doesnt-check-unescaped-quote) I've found that the eval() in Tools/i18n/msgfmt.py allows arbitrary code