Skip to content

Commit 3fe86a4

Browse files
author
Adam Hrbac
committed
Ensure co_consts doesn't provide python access to a raw java array
At some point in jinja2.loaders, the code object for the function load gets hashed. Since this function contains the list view ['root'], it used to be placed into co_consts as a singleton Object[] containing a TruffleString. This then made the hash crash. This way it is stored as a tuple and can get hashed normally, fixing the issue
1 parent 513a262 commit 3fe86a4

File tree

2 files changed

+13
-0
lines changed
  • graalpython
    • com.oracle.graal.python.test/src/tests
    • com.oracle.graal.python/src/com/oracle/graal/python/builtins/objects/code

2 files changed

+13
-0
lines changed

graalpython/com.oracle.graal.python.test/src/tests/test_code.py

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,3 +249,10 @@ def inner():
249249
if type(const) == types.CodeType:
250250
code = const
251251
assert "this is fun" in code.co_consts
252+
253+
254+
def test_consts_do_not_leak_java_types():
255+
codestr = "['root']"
256+
code = compile(codestr, '<test>', 'exec')
257+
for const in code.co_consts:
258+
assert isinstance(const, (str, tuple)) or const is None

graalpython/com.oracle.graal.python/src/com/oracle/graal/python/builtins/objects/code/PCode.java

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,7 @@
7979
import com.oracle.graal.python.nodes.generator.GeneratorFunctionRootNode;
8080
import com.oracle.graal.python.nodes.literal.SimpleLiteralNode;
8181
import com.oracle.graal.python.nodes.literal.TupleLiteralNode;
82+
import com.oracle.graal.python.nodes.object.IsForeignObjectNode;
8283
import com.oracle.graal.python.runtime.GilNode;
8384
import com.oracle.graal.python.runtime.PythonContext;
8485
import com.oracle.graal.python.runtime.object.PythonObjectFactory;
@@ -633,7 +634,12 @@ private static Object convertConstantToPythonSpace(RootNode rootNode, Object o)
633634
Object[] array = new Object[strings.length];
634635
System.arraycopy(strings, 0, array, 0, strings.length);
635636
return factory.createTuple(array);
637+
} else if (o instanceof Object[]) {
638+
Object[] objects = (Object[]) o;
639+
return factory.createTuple(objects.clone());
636640
}
641+
// Ensure no conversion is missing
642+
assert !IsForeignObjectNode.getUncached().execute(o);
637643
return o;
638644
}
639645

0 commit comments

Comments
 (0)