From: chgnrdv <52372310+chgnrdv@users.noreply.github.com>
Date: Thu, 20 Oct 2022 00:25:10 +0000 (+0300)
Subject: gh-98354: Add unicode check for 'name' attribute in _imp_create_builtin (GH-98412)
X-Git-Tag: v3.12.0a1~49
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=1f369ad07ff44b1fd6db75b33298e20ad604efc8;p=thirdparty%2FPython%2Fcpython.git

gh-98354: Add unicode check for 'name' attribute in _imp_create_builtin (GH-98412)



Fixes #98354
---

diff --git a/Lib/test/test_imp.py b/Lib/test/test_imp.py
index 35b6afa91ebd..446e913e5bf3 100644
--- a/Lib/test/test_imp.py
+++ b/Lib/test/test_imp.py
@@ -378,6 +378,40 @@ class ImportTests(unittest.TestCase):
             mod = imp.load_module('mymod', file, path, description)
         self.assertEqual(mod.x, 42)
 
+    def test_issue98354(self):
+        # _imp.create_builtin should raise TypeError
+        # if 'name' attribute of 'spec' argument is not a 'str' instance
+
+        create_builtin = support.get_attribute(_imp, "create_builtin")
+
+        class FakeSpec:
+            def __init__(self, name):
+                self.name = self
+        spec = FakeSpec("time")
+        with self.assertRaises(TypeError):
+            create_builtin(spec)
+
+        class FakeSpec2:
+            name = [1, 2, 3, 4]
+        spec = FakeSpec2()
+        with self.assertRaises(TypeError):
+            create_builtin(spec)
+
+        import builtins
+        class UnicodeSubclass(str):
+            pass
+        class GoodSpec:
+            name = UnicodeSubclass("builtins")
+        spec = GoodSpec()
+        bltin = create_builtin(spec)
+        self.assertEqual(bltin, builtins)
+
+        class UnicodeSubclassFakeSpec(str):
+            def __init__(self, name):
+                self.name = self
+        spec = UnicodeSubclassFakeSpec("builtins")
+        bltin = create_builtin(spec)
+        self.assertEqual(bltin, builtins)
 
 class ReloadTests(unittest.TestCase):
 
diff --git a/Misc/NEWS.d/next/Core and Builtins/2022-10-19-18-03-28.gh-issue-98354.GRGta3.rst b/Misc/NEWS.d/next/Core and Builtins/2022-10-19-18-03-28.gh-issue-98354.GRGta3.rst
new file mode 100644
index 000000000000..a600f3e927a3
--- /dev/null
+++ b/Misc/NEWS.d/next/Core and Builtins/2022-10-19-18-03-28.gh-issue-98354.GRGta3.rst	
@@ -0,0 +1 @@
+Added unicode check for ``name`` attribute of ``spec`` argument passed in :func:`_imp.create_builtin` function.
diff --git a/Python/import.c b/Python/import.c
index 698ef37ce0a1..9d35d2617742 100644
--- a/Python/import.c
+++ b/Python/import.c
@@ -1021,6 +1021,14 @@ _imp_create_builtin(PyObject *module, PyObject *spec)
         return NULL;
     }
 
+    if (!PyUnicode_Check(name)) {
+        PyErr_Format(PyExc_TypeError,
+                     "name must be string, not %.200s",
+                     Py_TYPE(name)->tp_name);
+        Py_DECREF(name);
+        return NULL;
+    }
+
     PyObject *mod = create_builtin(tstate, name, spec);
     Py_DECREF(name);
     return mod;