Validate assembly name before calling LoadAssembly

Mario Beretta · Mario Beretta · commit 2d839f3dc0a6 · 2021-09-09T12:59:10.000Z
diff --git a/src/runtime/moduleobject.cs b/src/runtime/moduleobject.cs
@@ -4,6 +4,7 @@
 using System.IO;
 using System.Reflection;
 using System.Runtime.InteropServices;
+using System.Text.RegularExpressions;
 
 namespace Python.Runtime
 {
@@ -504,6 +505,13 @@ public static bool SuppressOverloads
             set { _SuppressOverloads = value; }
         }
 
+        private static bool IsValidAssemblyName(string name)
+        {
+            string typeName = name.Split(',')[0];
+            if (typeName.Contains(Path.DirectorySeparatorChar)) return false;
+            return true;
+        }
+
         [ModuleFunction]
         [ForbidPythonThreads]
         public static Assembly AddReference(string name)
@@ -518,7 +526,8 @@ public static Assembly AddReference(string name)
             }
             if (assembly == null)
             {
-                assembly = AssemblyManager.LoadAssembly(name);
+                if (IsValidAssemblyName(name))
+                    assembly = AssemblyManager.LoadAssembly(name);
             }
             if (assembly == null)
             {

Original file line number	Diff line number	Diff line change
`@@ -4,6 +4,7 @@`
`4`	`4`	`using System.IO;`
`5`	`5`	`using System.Reflection;`
`6`	`6`	`using System.Runtime.InteropServices;`
	`7`	`+using System.Text.RegularExpressions;`
`7`	`8`
`8`	`9`	`namespace Python.Runtime`
`9`	`10`	`{`
`@@ -504,6 +505,13 @@ public static bool SuppressOverloads`
`504`	`505`	`set { _SuppressOverloads = value; }`
`505`	`506`	`}`
`506`	`507`
	`508`	`+ private static bool IsValidAssemblyName(string name)`
	`509`	`+ {`
	`510`	`+ string typeName = name.Split(',')[0];`
	`511`	`+ if (typeName.Contains(Path.DirectorySeparatorChar)) return false;`
	`512`	`+ return true;`
	`513`	`+ }`
	`514`	`+`
`507`	`515`	`[ModuleFunction]`
`508`	`516`	`[ForbidPythonThreads]`
`509`	`517`	`public static Assembly AddReference(string name)`
`@@ -518,7 +526,8 @@ public static Assembly AddReference(string name)`
`518`	`526`	`}`
`519`	`527`	`if (assembly == null)`
`520`	`528`	`{`
`521`		`- assembly = AssemblyManager.LoadAssembly(name);`
	`529`	`+ if (IsValidAssemblyName(name))`
	`530`	`+ assembly = AssemblyManager.LoadAssembly(name);`
`522`	`531`	`}`
`523`	`532`	`if (assembly == null)`
`524`	`533`	`{`