_elementtree.c import can fail silently #47725

Activity

1. naufraghi commented on Jul 31, 2008

   

   naufraghimannequin

   on Jul 31, 2008

   MannequinAuthor

   More actions

   Playing with PyInstaller I have found that the final part of
   _elementtree.c:

   Index: Modules/_elementtree.c
   ===================================================================
   --- Modules/_elementtree.c (revisione 59540)
   +++ Modules/_elementtree.c (copia locale)
   @@ -2780,7 +2780,10 @@

      );
   

   • PyRun_String(bootstrap, Py_file_input, g, NULL);
     + if (PyRun_String(bootstrap, Py_file_input, g, NULL) == NULL)
     + return;

       elementpath_obj = PyDict_GetItemString(g, "ElementPath");

   execute a bit of python code without checking the return value.
   That can lead to weird things playing with import hooks,
   for example an assert like this can fail:

   Index: Lib/test/test_elemettree.py
   ===================================================================

   --- Lib/test/test_elemettree.py (revisione 0)
   +++ Lib/test/test_elemettree.py (revisione 0)
   @@ -0,0 +1,21 @@
   +#! /usr/bin/env python
   +
   +def importHook(*args, **kwargs):
   +    if 'xml.etree' in args:
   +        raise ImportError
   +    else:
   +        return __real__import__(*args, **kwargs)
   +
   +import os
   +import __builtin__
   +__real__import__ = __builtin__.__import__
   +__builtin__.__import__ = importHook
   +
   +try:
   +    import xml.etree.cElementTree as cET
   +except ImportError:
   +    pass
   +else:
   +    out = os.popen("python -c 'import xml.etree.cElementTree as cET; 
   print dir(cET)'").read().strip()
   +    assert str(dir(cET)) == out, (str(dir(cET)), out)
   +
2. naufraghi

   added

   topic-XML

   on Jul 31, 2008
3. loewis commented on Jul 31, 2008

   

   loewismannequin

   on Jul 31, 2008

   Mannequin

   More actions

   Fredrik, can you take a look?
4. loewis

   assigned

   effbot

   on Jul 31, 2008
5. effbot commented on Aug 3, 2008

   

   effbotmannequin

   on Aug 3, 2008

   Mannequin

   More actions

   This is fixed in the ET 1.3-compatible codebase. Since it's too late to
   add ET 1.3 to 2.6, I guess it's time to make a new 1.2 bugfix release
   for 2.6.
6. ferringb commented on Nov 8, 2009

   

   ferringbmannequin

   on Nov 8, 2009

   Mannequin

   More actions

   At this point, this affects 2.5, 2.6, and 3.1 (and the normal 1.0.5
   release of cElementTree); what's required to get this fixed and queued
   up for micro/minor releases?

   Sidenote, the patch posted above still leaks a reference-
7. loewis commented on Nov 8, 2009

   

   loewismannequin

   on Nov 8, 2009

   Mannequin

   More actions

   For 2.5, this will not be fixed, as it is not security-critical.
8. effbot commented on Nov 8, 2009

   

   effbotmannequin

   on Nov 8, 2009

   Mannequin

   More actions

   Note that "fail silently" is a bit of a misnomer - if the embedded import
   doesn't work, portions of the library will fail pretty loudly. Feel free
   to use some variation of the suggested patch, or just wait until the next
   upstream release gets imported (if ever).
9. florentx

   added

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   on Feb 13, 2010
10. florentx commented on Mar 11, 2010

    

    florentxmannequin

    on Mar 11, 2010

    Mannequin

    More actions

    Fixed with latest xml.etree.
11. florentx

    closed this as completedon Mar 11, 2010
12. ezio-melotti

    transferred this issue fromon Apr 10, 2022