[security][3.3] bpo-30730: Prevent environment variables injection in subprocess on Windows. (GH-2325) by serhiy-storchaka · Pull Request #2363

[security][3.3] bpo-30730: Prevent environment variables injection in subprocess on Windows. (GH-2325) by serhiy-storchaka · Pull Request #2363 · python/cpython

Merged

ned-deily merged 4 commits intopython:3.3from

serhiy-storchaka:backport-d174d24-3.3

Jul 19, 2017

Merged

[security][3.3] bpo-30730: Prevent environment variables injection in subprocess on Windows. (GH-2325)#2363
ned-deily merged 4 commits intopython:3.3from
serhiy-storchaka:backport-d174d24-3.3

Conversation

Copy link Copy Markdown

Member

serhiy-storchaka commented
Jun 23, 2017

Prevent passing other invalid environment variables and command arguments..
(cherry picked from commit d174d24)

serhiy-storchaka added OS-windows type-security

A security issue

labels

Jun 23, 2017

the-knights-who-say-ni added the CLA signed label

Jun 23, 2017

Copy link Copy Markdown

mention-bot commented
Jun 23, 2017

@serhiy-storchaka, thanks for your PR! By analyzing the history of the files in this pull request, we identified @gvanrossum, @gpshead and @tim-one to be potential reviewers.

[3.3] bpo-30730: Prevent environment variables injection in subproces…

84bfcb8

…s on Windows. (pythonGH-2325)

Prevent passing other invalid environment variables and command arguments..
(cherry picked from commit d174d24)

serhiy-storchaka force-pushed the backport-d174d24-3.3 branch from b414d61 to 84bfcb8 Compare

June 24, 2017 13:26

vstinner changed the title ~~[3.3] bpo-30730: Prevent environment variables injection in subprocess on Windows. (GH-2325)~~ [security][3.3] bpo-30730: Prevent environment variables injection in subprocess on Windows. (GH-2325)