UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

docs: kernel_feat.py: fix potential command injection 

[ Upstream commit c48a7c44a1d02516309015b6134c9bb982e17008 ]

The kernel-feat directive passes its argument straight to the shell.
This is unfortunate and unnecessary.

Let's always use paths relative to $srctree/Documentation/ and use
subprocess.check_call() instead of subprocess.Popen(shell=True).

This also makes the code shorter.

This is analogous to commit 3231dd586277 ("docs: kernel_abi.py: fix
command injection") where we did exactly the same thing for
kernel_abi.py, somehow I completely missed this one.

Link: https://fosstodon.org/@jani/111676532203641247
Reported-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Link: https://lore.kernel.org/r/20240110174758.3680506-1-vegard.nossum@oracle.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Vegard Nossum 2024-01-10 18:47:58 +01:00 committed by Greg Kroah-Hartman
parent db6e7e5fd4
commit e961f8c696
20 changed files with 31 additions and 64 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Documentation/admin-guide/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features
.. kernel-feat:: features

2
Documentation/arch/arc/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features arc
.. kernel-feat:: features arc

2
Documentation/arch/arm/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features arm
.. kernel-feat:: features arm

2
Documentation/arch/arm64/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features arm64
.. kernel-feat:: features arm64

2
Documentation/arch/loongarch/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features loongarch
.. kernel-feat:: features loongarch

2
Documentation/arch/m68k/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features m68k
.. kernel-feat:: features m68k

2
Documentation/arch/mips/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features mips
.. kernel-feat:: features mips

2
Documentation/arch/nios2/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features nios2
.. kernel-feat:: features nios2

2
Documentation/arch/openrisc/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features openrisc
.. kernel-feat:: features openrisc

2
Documentation/arch/parisc/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features parisc
.. kernel-feat:: features parisc

2
Documentation/arch/s390/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features s390
.. kernel-feat:: features s390

2
Documentation/arch/sh/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features sh
.. kernel-feat:: features sh

2
Documentation/arch/sparc/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features sparc
.. kernel-feat:: features sparc

2
Documentation/arch/x86/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features x86
.. kernel-feat:: features x86

2
Documentation/arch/xtensa/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features xtensa
.. kernel-feat:: features xtensa

2
Documentation/powerpc/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features powerpc
.. kernel-feat:: features powerpc

2
Documentation/riscv/features.rst
View File

@ -1,3 +1,3 @@
.. SPDX-License-Identifier: GPL-2.0
.. kernel-feat:: $srctree/Documentation/features riscv
.. kernel-feat:: features riscv

57
Documentation/sphinx/kernel_feat.py
View File

@ -37,8 +37,6 @@ import re
import subprocess
import sys
from os import path
from docutils import nodes, statemachine
from docutils.statemachine import ViewList
from docutils.parsers.rst import directives, Directive
@ -76,33 +74,26 @@ class KernelFeat(Directive):
self.state.document.settings.env.app.warn(message, prefix="")
def run(self):
doc = self.state.document
if not doc.settings.file_insertion_enabled:
raise self.warning("docutils: file insertion disabled")
env = doc.settings.env
cwd = path.dirname(doc.current_source)
cmd = "get_feat.pl rest --enable-fname --dir "
cmd += self.arguments[0]
srctree = os.path.abspath(os.environ["srctree"])
args = [
os.path.join(srctree, 'scripts/get_feat.pl'),
'rest',
'--enable-fname',
'--dir',
os.path.join(srctree, 'Documentation', self.arguments[0]),
]
if len(self.arguments) > 1:
cmd += " --arch " + self.arguments[1]
args.extend(['--arch', self.arguments[1]])
srctree = path.abspath(os.environ["srctree"])
fname = cmd
# extend PATH with $(srctree)/scripts
path_env = os.pathsep.join([
srctree + os.sep + "scripts",
os.environ["PATH"]
])
shell_env = os.environ.copy()
shell_env["PATH"] = path_env
shell_env["srctree"] = srctree
lines = self.runCmd(cmd, shell=True, cwd=cwd, env=shell_env)
lines = subprocess.check_output(args, cwd=os.path.dirname(doc.current_source)).decode('utf-8')
line_regex = re.compile("^\.\. FILE (\S+)$")
@ -121,30 +112,6 @@ class KernelFeat(Directive):
nodeList = self.nestedParse(out_lines, fname)
return nodeList
def runCmd(self, cmd, **kwargs):
u"""Run command ``cmd`` and return its stdout as unicode."""
try:
proc = subprocess.Popen(
cmd
, stdout = subprocess.PIPE
, stderr = subprocess.PIPE
, **kwargs
)
out, err = proc.communicate()
out, err = codecs.decode(out, 'utf-8'), codecs.decode(err, 'utf-8')
if proc.returncode != 0:
raise self.severe(
u"command '%s' failed with return code %d"
% (cmd, proc.returncode)
)
except OSError as exc:
raise self.severe(u"problems with '%s' directive: %s."
% (self.name, ErrorString(exc)))
return out
def nestedParse(self, lines, fname):
content = ViewList()
node = nodes.section()

2
Documentation/translations/zh_CN/arch/loongarch/features.rst
View File

@ -5,4 +5,4 @@
:Original: Documentation/arch/loongarch/features.rst
:Translator: Huacai Chen <chenhuacai@loongson.cn>
.. kernel-feat:: $srctree/Documentation/features loongarch
.. kernel-feat:: features loongarch

2
Documentation/translations/zh_CN/arch/mips/features.rst
View File

@ -10,4 +10,4 @@
.. _cn_features:
.. kernel-feat:: $srctree/Documentation/features mips
.. kernel-feat:: features mips