zoneinfo.ZoneInfo does not check for Windows device names

[apple502j]

BPO	44829
Nosy	@pfmoore, @abalkin, @tjguk, @zware, @eryksun, @zooba, @pganssle, @apple502j

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = None
created_at = <Date 2021-08-04.14:36:58.051>
labels = ['type-bug', '3.9', '3.10', '3.11', 'library', 'OS-windows']
title = 'zoneinfo.ZoneInfo does not check for Windows device names'
updated_at = <Date 2021-08-04.18:03:38.350>
user = 'https://github.com/apple502j'

bugs.python.org fields:

activity = <Date 2021-08-04.18:03:38.350>
actor = 'eryksun'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Library (Lib)', 'Windows']
creation = <Date 2021-08-04.14:36:58.051>
creator = 'apple502j'
dependencies = []
files = []
hgrepos = []
issue_num = 44829
keywords = []
message_count = 2.0
messages = ['398900', '398918']
nosy_count = 8.0
nosy_names = ['paul.moore', 'belopolsky', 'tim.golden', 'zach.ware', 'eryksun', 'steve.dower', 'p-ganssle', 'apple502j']
pr_nums = []
priority = 'normal'
resolution = None
stage = None
status = 'open'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue44829'
versions = ['Python 3.9', 'Python 3.10', 'Python 3.11']

Linked PRs

• gh-88992: Mention installation artifacts as de-facto resources #136419

[apple502j]

Note: this issue was submitted to security@ due to its potential as a DoS vector on 2021-05-08, but I have not received a response (excluding the automated email). It is over 88 days since the report, so I am now reporting this publicly.

Issue: zoneinfo.ZoneInfo does not check for Windows device names on Windows. For example, a timezone "NUL" do not raise ZoneInfoNotFoundError; instead, it raises ValueError ("Invalid TZif file: magic not found").

If the timezone passed is "CON", then the program would read the content from stdin, and parse it as tzdata file.

This can be abused for a DoS attack for programs that call ZoneInfo with untrusted timezone; for example, since reading CON is a blocking operation in the asyncio world, a web server that calls ZoneInfo with untrusted timezone input would stop its job and no future connections will succeed.

Note that this bug only occurs on Windows for obvious reasons.

Repro case:
>>> from zoneinfo import ZoneInfo
>>> ZoneInfo("CON")

This is related to bpo-41530 where timezone __init__.py does not raise ZoneInfoNotFoundError.

And finally, this happens with other file-based operations (and they are probably intentional); however, zoneinfo is designed to be secure by default, for example by disallowing path traversals. The interactions with Windows device names are not documented at all in the references. It's a common practice to let the users choose their preferred timezone in web applications, and such programs are expected to call ZoneInfo constructor with externally provided string. Timezone calculation should never cause a web server to stop to read stdin.

[pganssle]

Sorry you didn't receive a response to your security@ email, I guess my response just went to the PSRT, not to you as well. I believe we determined that this was an issue in importlib.resources generally, not specific to zoneinfo.

I think importlib.resources.open_binary should check if a resource is a file with os.isfile before opening it. That will solve the issue in zoneinfo and other similar situations.