gh-68966: Document mailcap shell injection vulnerability

[vstinner]

No description provided.

[vstinner]

As discussed on the (private) Python Security Response Team, we can simply document the shell command injection vulnerability in the mailcap documentation, as we did for other vulnerabilities:

• pickle must not be used to deserialize untrusted data: https://docs.python.org/dev/library/pickle.html
• XML parsers of Python stdlib have multiple vulnerabilities: https://docs.python.org/dev/library/xml.html#xml-vulnerabilities
• TLS connection of many network protocols don't validate the certificate: see issue Enable TLS certificate validation by default for SMTP/IMAP/FTP/POP/NNTP protocols #91826
• etc.

The Python documentation now even has a list of dangerous APIs / known vulnerabilities: https://docs.python.org/dev/library/security_warnings.html

---

It seems like there is no simple way to fix the #68966 vulnerability without changing the behavior for legit filenames.

[encukou]

It's not only about the filename. The MIME type and parameter list need to be validated as well.
Also, how should they be validated? That's not clear.

[vstinner]

You're right, I rephrased the warning.

[vstinner]

"The caller is responsible to validate and sanitize input arguments."

[vstinner]

#91993 got merged, I close this issue.