From 8531b01d6cdf0b70f256f93092caa2a5d91afc11 Mon Sep 17 00:00:00 2001 From: Andrew Murray Date: Sun, 2 Jan 2022 17:23:49 +1100 Subject: [PATCH] Restrict builtins for ImageMath.eval CVE: CVE-2022-22817 Upstream-Status: Backport (https://github.com/python-pillow/Pillow/pull/5923/commits/8531b01d6cdf0b70f256f93092caa2a5d91afc11) Signed-off-by: Trevor Gamblin --- Tests/test_imagemath.py | 7 +++++++ src/PIL/ImageMath.py | 7 ++++++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/Tests/test_imagemath.py b/Tests/test_imagemath.py index e7afd1ab..25811aa8 100644 --- a/Tests/test_imagemath.py +++ b/Tests/test_imagemath.py @@ -1,3 +1,5 @@ +import pytest + from PIL import Image, ImageMath @@ -50,6 +52,11 @@ def test_ops(): assert pixel(ImageMath.eval("float(B)**33", images)) == "F 8589934592.0" +def test_prevent_exec(): + with pytest.raises(ValueError): + ImageMath.eval("exec('pass')") + + def test_logical(): assert pixel(ImageMath.eval("not A", images)) == 0 assert pixel(ImageMath.eval("A and B", images)) == "L 2" diff --git a/src/PIL/ImageMath.py b/src/PIL/ImageMath.py index 7f9c88e1..06bea800 100644 --- a/src/PIL/ImageMath.py +++ b/src/PIL/ImageMath.py @@ -246,7 +246,12 @@ def eval(expression, _dict={}, **kw): if hasattr(v, "im"): args[k] = _Operand(v) - out = builtins.eval(expression, args) + code = compile(expression, "", "eval") + for name in code.co_names: + if name not in args and name != "abs": + raise ValueError(f"'{name}' not allowed") + + out = builtins.eval(expression, {"__builtins": {"abs": abs}}, args) try: return out.im except AttributeError: -- 2.33.0