1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-11 05:18:09 +03:00
samba-mirror/python
Douglas Bagnall dab828f63c pytest/source_char: check for mixed direction text
As pointed out in https://lwn.net/Articles/875964, forbidding bidi
marker characters is not always going to be enough to avoid
right-to-left vs left-to-right confusion. Consider this:

$ python -c's = "b = x  # 2 * n * m"; print(s); print(s.replace("x", "א").replace("n", "ח"))'

b = x  # 2 * n * m
b = א  # 2 * ח * m

Those two lines are semantically the same, with the Hebrew letters
"א" and "ח" replacing "x" and "n". But they look like they mean
different things.

It is not enough to say we only allow these scripts (or indeed
non-ascii) in strings and comments, as demonstrated in this example:

$ python -c's = "b = \"x#\"  #  n"; print(s); print(s.replace("x", "א").replace("n", "ח"))'

b = "x#"  #  n
b = "א#"  #  ח

where the second line is visually disordered but looks valid. Any series
of neutral characters between teo RTL characters will be reversed (and
possibly mirrored).

In practice this affects one file, which is a text file for testing
unicode normalisation.

I think, for the reasons shown above, we are unlikely to see legitimate
RTL code outside perhaps of documentation files — but if we do, we can
add those files to the allow-list.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Dec  3 18:53:43 UTC 2021 on sn-devel-184
2021-12-03 18:53:43 +00:00
..
examples examples: Make winreg.py sample work with python3 in current master 2021-07-19 17:44:08 +00:00
samba pytest/source_char: check for mixed direction text 2021-12-03 18:53:43 +00:00
modules.c py3: Remove PyStr_FromString() compatability macro 2019-06-24 17:24:27 +00:00
modules.h python: Create macro to hide ugly function signature cast 2019-05-16 17:55:16 +00:00
py3compat.h py3compat: remove obsolete comments 2021-03-17 17:10:32 +00:00
pyglue.c selftest: Add test of NDR marshalling from python, starting with wbint 2021-06-02 03:56:36 +00:00
wscript python:waf: Correctly check for python-dateutil 2021-07-21 11:27:36 +00:00