Prudently, TALES string expressions attempt to prevent use of non-simple path expressions in their interpolated expressions. The regular expression used to detect this is flawed, and non-simple path expressions may be inserted simply by prefixing the path with a subpath which evaluates to False or raises an exception. For example:
string:foo ${python:bar} baz
would raise a compiler error;
string:foo ${nothing/nothing|python:bar} baz
would not, but would yield the same expected result.
The definition of the _interp regular expression in zope.tales.expressions could be improved like so to prevent this:
_interp = re.compile(r'\$(%(n)s)|\${(%(n)s(?:/[^}|]*)*(?:\|%(n)s(?:/[^}|]*)*)*)}' % {'n': NAME_RE})
>>> _interp.findall('$spam ham ${eggs} ${foo/bar} ${waldo/plugh|corge} ${python:qux} ${xyzzy|python:quux} ${fred/thud|python:grault|not:garply}')
[('spam', ''), ('', 'eggs'), ('', 'foo/bar'), ('', 'waldo/plugh|corge')]
Not sure if this is strictly a security bug, but reporting it as one just in case.
Thanks for the report: I wouldn't class it as a security vulnerability, but
merely a failure to enforce the TALES spec:
http://