[ pyobjc-Bugs-3085651 ] Unsafe NSLog in PyObjCTools.Debugging.nsLogPythonException

Bugs item #3085651, was opened at 2010-10-11 21:21
Message generated for change (Tracker Item Submitted) made by kthomases
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=114534&aid=3085651&group_id=14534

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Ken Thomases (kthomases)
Assigned to: Nobody/Anonymous (nobody)
Summary: Unsafe NSLog in PyObjCTools.Debugging.nsLogPythonException

Initial Comment:
In PyObjCTools.Debugging.nsLogPythonException, the exception is formatted into a string, which is then passed as the first/only argument to NSLog.  The problem is that NSLog treats its first argument as a format string.  The formatted exception may contain percent ('%') characters, which will be interpreted as format specifiers.  Since there are no arguments for those specifiers, an exception is thrown (during logging of an exception).

It results in something like this:

*** Exception occurred during exception handler ***
Traceback (most recent call last):
  File "/System/Library/Frameworks/Python.framework/Versions/2.5/Extras/lib/python/PyObjCTools/Debugging.py", line 83, in exceptionHandler_shouldLogException_mask_
  File "/System/Library/Frameworks/Python.framework/Versions/2.5/Extras/lib/python/PyObjCTools/Debugging.py", line 47, in nsLogPythonException
ValueError: Too few arguments for format string [cur:1/len:1]
2010-10-11 20:47:03.946 CrossOver[497:903] NSExceptionHandler has recorded the following exception:
OC_PythonException -- <type 'exceptions.KeyError'>: u'Key needs_download does not exist'
Stack trace:  0x96155d24  0x97082509  0x98c2a9f1  0x150b2cb8  0x1508c5fe  0x331d4  0x33500  0x32f73  0x97f8cf1e  0x9806c699  0x98068146  0x9806743d  0x980bca61  0x98065e93  0x98063e9c  0x97f7caff  0x255f06  0x97f105bb  0x97f085ed  0x25e676  0x83b10  0x2c92  0x1


When I add a proper format string (u'%@') to the NSLog call, the same path through my code produces a properly-logged exception:

2010-10-11 20:54:26.587 CrossOver[760:903] *** Python exception discarded!
Traceback (most recent call last):
  File "/System/Library/Frameworks/Python.framework/Versions/2.5/Extras/lib/python/PyObjC/PyObjCTools/KeyValueCoding.py", line 213, in getKey
    raise KeyError, "Key %s does not exist" % (key,)
KeyError: u'Key needs_download does not exist'


You can see the '%s' in the traceback which is the "bomb" for the unsafe NSLog call.

It's probably a good idea to review all uses of NSLog for similar unsafe calling.  The first argument should always be a constant, not a run-time-computed string.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=114534&aid=3085651&group_id=14534

------------------------------------------------------------------------------
Beautiful is writing same markup. Internet Explorer 9 supports
standards for HTML5, CSS3, SVG 1.1,  ECMAScript5, and DOM L2 & L3.
Spend less time writing and  rewriting code and more time creating great
experiences on the web. Be a part of the beta today.
http://p.sf.net/sfu/beautyoftheweb