Skip to content

Fix whitespace padding of day of month in changelog entries #511

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
centosinfra-prod-github-app merged 1 commit into from
Feb 12, 2026
Merged

Fix whitespace padding of day of month in changelog entries #511

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions specfile/changelog.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -241,10 +241,10 @@ def assemble(
header = _OPENSUSE_CHANGELOG_SEPARATOR + "\n"
header += f"{weekday} {month}"

if day_of_month_padding.endswith("0"):
header += f" {day_of_month_padding[:-1]}{timestamp.day:02}"
if day_of_month_padding:
header += f" {day_of_month_padding[:-1]}{timestamp.day:{day_of_month_padding[-1]}>2}"
Comment on lines +244 to +245
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot Feb 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-medium medium

The assemble method constructs a format string for timestamp.day using the day_of_month_padding parameter. This introduces a Format String Injection vulnerability, as the last character of day_of_month_padding is used as a fill character in the format specifier ({timestamp.day:{day_of_month_padding[-1]}>2}). If day_of_month_padding is user-controlled, an attacker could inject characters, potentially leading to unexpected output, file corruption, or denial of service. Although Python's format strings are generally safe, dynamic construction from external input is a security risk. Additionally, the current logic is a bit dense and could be hard to understand at a glance; consider improving readability for better maintainability.

Suggested change
if day_of_month_padding:
header += f" {day_of_month_padding[:-1]}{timestamp.day:{day_of_month_padding[-1]}>2}"
if day_of_month_padding and day_of_month_padding[-1] in (' ', '0'):
header += f" {day_of_month_padding[:-1]}{timestamp.day:{day_of_month_padding[-1]}>2}"

Copy link
Copy Markdown
Member Author

@nforro nforro Feb 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

an attacker could inject characters, potentially leading to unexpected output, file corruption, or denial of service

Like what?

else:
header += f" {day_of_month_padding}{timestamp.day}"
header += f" {timestamp.day}"

# convert to extended format for openSUSE style changelogs
if style == ChangelogStyle.openSUSE and not isinstance(
Expand Down
24 changes: 24 additions & 0 deletions tests/unit/test_changelog.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -452,9 +452,33 @@ def test_get_raw_section_data():
],
"0.4-1",
),
ChangelogEntry.assemble(
datetime.date(2026, 2, 9),
"Nikola Forró <nforro@redhat.com>",
[
"* whitespace day of month padding",
],
"0.4-2",
day_of_month_padding=" ",
),
ChangelogEntry.assemble(
datetime.date(2026, 2, 19),
"Nikola Forró <nforro@redhat.com>",
[
"* whitespace day of month padding #2",
],
"0.4-3",
day_of_month_padding=" ",
),
]
)
assert changelog.get_raw_section_data() == [
"* Thu Feb 19 2026 Nikola Forró <nforro@redhat.com> - 0.4-3",
"* whitespace day of month padding #2",
"",
"* Mon Feb 9 2026 Nikola Forró <nforro@redhat.com> - 0.4-2",
"* whitespace day of month padding",
"",
"* Fri Jan 27 2023 Nikola Forró <nforro@redhat.com> - 0.4-1",
"",
"* this is also a valid entry",
Expand Down
Loading