[ZCM] [ZC] 2140/ 2 Resolve "Serious security hole in docutils?"

Issue #2140 Update (Resolve) "Serious security hole in docutils?"
 ** Security Related ** (Public)
 Status Resolved, Zope/bug critical
To followup, visit:
  http://www.zope.org/Collectors/Zope/2140

==============================================================
= Resolve - Entry #2 by ajung on Jan 10, 2007 9:47 pm

 Status: Pending => Resolved

Should be solved meanwhile.
________________________________________
= Request - Entry #1 by jim on Jul 5, 2006 11:25 am

One of the docutils developers just gave a lightening talk at EP
describing a security issue in docutils that potentially effects Zope 2.

Previously, we had a security fix that required setting file_insertion_enabled
to False.  We should also have set raw_enabled to disable the raw directive,
which also allows arbitrary file or URL insertion. :(

We should also review other directives or considering disabling
TTW reST.

Is anyone familiar with how we use reST in Z2 or know who is?
Obviously, we need to react to this quickly. :(  I'm not familiar with how
we're using reST myself.

Note that:


A grep for file_insertion_enabled in a 2.9 checkout finds:

./lib/python/Products/ZReST/ZReST.py:211:            pub.settings.file_insertion_enabled = 0
./lib/python/reStructuredText/__init__.py:74:    settings['file_insertion_enabled'] = 0

I really don't know what ZRest is or how we're using the reStructuredText module.


==============================================================