Security: Arbitrary Code Execution via exec() on File Content

[barttran2k]

Problem

The calc_headers function reads, compiles, and executes the content of aiohttp/hdrs.py using exec(code, globs). If an attacker can modify hdrs.py (e.g., through a supply chain attack or compromised repository), arbitrary code would be executed when this tool script is run. The tool is used to generate C source files that get compiled into the library.

Severity: medium
File: tools/gen.py

Solution

Instead of using exec(), parse hdrs.py with the ast module to safely extract the header constants: import ast; tree = ast.parse(hdrs_file.read_text()); # extract string assignments from the AST.

Changes

• tools/gen.py (modified)

Testing

• Existing tests pass
• Manual review completed
• No new warnings/errors introduced

[codspeed-hq]

Merging this PR will improve performance by ×3.1

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 3 improved benchmarks
✅ 58 untouched benchmarks
⏩ 4 skipped benchmarks¹

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
⚡	test_get_request_with_251308_compressed_chunked_payload[isal.isal_zlib-pyloop]	62.4 ms	20.3 ms	×3.1
⚡	test_get_request_with_251308_compressed_chunked_payload[zlib-pyloop]	426.7 ms	353.1 ms	+20.83%
⚡	test_get_request_with_251308_compressed_chunked_payload[zlib_ng.zlib_ng-pyloop]	205.8 ms	168.3 ms	+22.28%

---

_{Comparing barttran2k:contribai/fix/security/arbitrary-code-execution-via-exec-on-fil (9d50881) with master (fc67cfd)}

Footnotes

1. 4 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[webknjaz]

Duplicate of #12331