python: escape rule values in generated validator source (string code injection)

The Python validator generates Python source from Jinja2 templates and then
exec()'s it (`python/protoc_gen_validate/validator.py:68` and `:217`). Six
template sites in `string_template` and one in `const_template` interpolate
string-typed `validate.rules` option values between literal Python quote
characters, e.g.

    if {{ name }} != "{{ o.string['const'] }}":
    if not "{{ s['contains'] }}" in {{ name }}:
    if re.search(r'{{ s['pattern'] }}', {{ name }}) is None:

A `.proto` file with a crafted rule string can close the surrounding Python
string literal and append arbitrary expressions or statements, which run on
the first call to `validate(msg)` for that descriptor (the generated
function is cached via `@lru_cache`).

This is the Python analogue of the Java code-injection class tracked in
issue/PR #1385.

Fix
---

Add a small `_pyrepr` helper that returns `repr(value)`, the canonical
Python-source literal representation, and pass it as `repr=` into every
affected `Template(...).render(...)` call. Rewrite each unsafe
`"{{ ... }}"` interpolation as `{{ repr(...) }}` so the value becomes a
single, properly-escaped Python literal. Error messages that previously
interpolated the same value inside their format string are restructured to
do runtime string concatenation with a separately-escaped literal, e.g.

    raise ValidationFailed("p.field does not contain " + {{ repr(s['contains']) }})

This preserves the existing user-visible error text on benign input,
keeps regex `{{ s['pattern'] }}` semantics (Python's `repr` produces a
non-raw literal whose backslashes evaluate back to the original regex),
and refuses injection on crafted input.

Reproduction (before patch)
---------------------------

    string evil = 1 [(validate.rules).string.contains =
      "x\" + __import__('os').system('touch /tmp/pgv-pwned') + \"y"];

Running validate(msg) on a message of this type touches
`/tmp/pgv-pwned`. After this patch the same payload is embedded as a
Python string literal `'x" + __import__(\'os\').system(...) + "y'` and
no command runs.

Sinks closed
------------

* `const_template`        string/bool/bytes `const`
* `in_template`           `in` / `not_in` (error message)
* `string_template`       `pattern`, `prefix`, `suffix`, `contains`, `not_contains`

Author: evilgensec

python/protoc_gen_validate/validator.py

@@ -21,6 +21,20 @@
 
 printer = ""
 
+
+def _pyrepr(value):
+    """Return a Python source literal that safely embeds `value` inside
+    generated validator code.
+
+    Validation rules from `.proto` files are rendered into Python source via
+    Jinja2 templates and then exec()'d.  Embedding a string between literal
+    Python quotes (e.g. ``"{{ s['contains'] }}"``) lets a crafted rule value
+    escape the literal and inject arbitrary Python.  Use this helper for
+    every rule value that appears in generated source so that the resulting
+    token is a single, properly-escaped Python literal.
+    """
+    return repr(value)
+
 # Well known regex mapping.
 regex_map = {
     "UNKNOWN": "",
@@ -300,36 +314,36 @@ def _has_field(message_pb, property_name):
 
 def const_template(option_value, name):
     const_tmpl = """{%- if str(o.string) and o.string.HasField('const') -%}
-    if {{ name }} != \"{{ o.string['const'] }}\":
-        raise ValidationFailed(\"{{ name }} not equal to {{ o.string['const'] }}\")
+    if {{ name }} != {{ repr(o.string['const']) }}:
+        raise ValidationFailed("{{ name }} not equal to " + {{ repr(o.string['const']) }})
     {%- elif str(o.bool) and o.bool['const'] != "" -%}
     if {{ name }} != {{ o.bool['const'] }}:
-        raise ValidationFailed(\"{{ name }} not equal to {{ o.bool['const'] }}\")
+        raise ValidationFailed("{{ name }} not equal to " + {{ repr(str(o.bool['const'])) }})
     {%- elif str(o.bytes) and o.bytes.HasField('const') -%}
         {% if sys.version_info[0] >= 3 %}
-    if {{ name }} != {{ o.bytes['const'] }}:
-        raise ValidationFailed(\"{{ name }} not equal to {{ o.bytes['const'] }}\")
+    if {{ name }} != {{ repr(o.bytes['const']) }}:
+        raise ValidationFailed("{{ name }} not equal to " + {{ repr(repr(o.bytes['const'])) }})
         {% else %}
-    if {{ name }} != b\"{{ o.bytes['const'].encode('string_escape') }}\":
-        raise ValidationFailed(\"{{ name }} not equal to {{ o.bytes['const'].encode('string_escape') }}\")
+    if {{ name }} != {{ repr(o.bytes['const']) }}:
+        raise ValidationFailed("{{ name }} not equal to " + {{ repr(repr(o.bytes['const'])) }})
         {% endif %}
     {%- endif -%}
     """
-    return Template(const_tmpl).render(sys=sys, o=option_value, name=name, str=str)
+    return Template(const_tmpl).render(sys=sys, o=option_value, name=name, str=str, repr=_pyrepr)
 
 
 def in_template(value, name):
     in_tmpl = """
     {%- if value['in'] %}
-    if {{ name }} not in {{ value['in'] }}:
-        raise ValidationFailed(\"{{ name }} not in {{ value['in'] }}\")
+    if {{ name }} not in {{ repr(list(value['in'])) }}:
+        raise ValidationFailed("{{ name }} not in " + {{ repr(repr(list(value['in']))) }})
     {%- endif -%}
     {%- if value['not_in'] %}
-    if {{ name }} in {{ value['not_in'] }}:
-        raise ValidationFailed(\"{{ name }} in {{ value['not_in'] }}\")
+    if {{ name }} in {{ repr(list(value['not_in'])) }}:
+        raise ValidationFailed("{{ name }} in " + {{ repr(repr(list(value['not_in']))) }})
     {%- endif -%}
     """
-    return Template(in_tmpl).render(value=value, name=name)
+    return Template(in_tmpl).render(value=value, name=name, repr=_pyrepr, list=list)
 
 
 def string_template(option_value, name):
@@ -376,24 +390,24 @@ def string_template(option_value, name):
         raise ValidationFailed(\"{{ name }} length is greater than {{ s['max_bytes'] }}\")
     {%- endif -%}
     {%- if s['pattern'] %}
-    if re.search(r\'{{ s['pattern'] }}\', {{ name }}) is None:
-        raise ValidationFailed(\"{{ name }} pattern does not match {{ s['pattern'] }}\")
+    if re.search({{ repr(s['pattern']) }}, {{ name }}) is None:
+        raise ValidationFailed("{{ name }} pattern does not match " + {{ repr(s['pattern']) }})
     {%- endif -%}
     {%- if s['prefix'] %}
-    if not {{ name }}.startswith(\"{{ s['prefix'] }}\"):
-        raise ValidationFailed(\"{{ name }} does not start with prefix {{ s['prefix'] }}\")
+    if not {{ name }}.startswith({{ repr(s['prefix']) }}):
+        raise ValidationFailed("{{ name }} does not start with prefix " + {{ repr(s['prefix']) }})
     {%- endif -%}
     {%- if s['suffix'] %}
-    if not {{ name }}.endswith(\"{{ s['suffix'] }}\"):
-        raise ValidationFailed(\"{{ name }} does not end with suffix {{ s['suffix'] }}\")
+    if not {{ name }}.endswith({{ repr(s['suffix']) }}):
+        raise ValidationFailed("{{ name }} does not end with suffix " + {{ repr(s['suffix']) }})
     {%- endif -%}
     {%- if s['contains'] %}
-    if not \"{{ s['contains'] }}\" in {{ name }}:
-        raise ValidationFailed(\"{{ name }} does not contain {{ s['contains'] }}\")
+    if {{ repr(s['contains']) }} not in {{ name }}:
+        raise ValidationFailed("{{ name }} does not contain " + {{ repr(s['contains']) }})
     {%- endif -%}
     {%- if s['not_contains'] %}
-    if \"{{ s['not_contains'] }}\" in {{ name }}:
-        raise ValidationFailed(\"{{ name }} contains {{ s['not_contains'] }}\")
+    if {{ repr(s['not_contains']) }} in {{ name }}:
+        raise ValidationFailed("{{ name }} contains " + {{ repr(s['not_contains']) }})
     {%- endif -%}
     {%- if s['email'] %}
     if not _validateEmail({{ name }}):
@@ -446,7 +460,7 @@ def string_template(option_value, name):
     {%- endif -%}
     {% endfilter %}
     """
-    return Template(str_templ).render(o=option_value, name=name, const_template=const_template, in_template=in_template)
+    return Template(str_templ).render(o=option_value, name=name, const_template=const_template, in_template=in_template, repr=_pyrepr)
 
 
 def required_template(value, name):