Gn00295120

The streaming engine fails to enforce restrictions set by the `--deny-funcs` flag when method-style function calls are used. This occurs because the `MethodPart::evaluate()` function invokes resolved functions without performing a capability check. Consequently, authenticated users with query submission privileges can bypass restrictions to execute denied functions using method syntax, such as `[1,2].map()` or `$f.put()` and `$f.get()`, allowing unauthorized reading and writing of file bucket data even when `file::*` permissions are denied.

In the `tornado.web.RedirectHandler` URL templates, regex-capture substitutions can be manipulated via crafted request paths to alter the redirect scheme or network location. This occurs when substitutions are placed at the start of a path, directly after a fixed host, or at the beginning of the template. This includes protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants that browsers interpret as attacker-controlled destinations. This flaw allows for an open redirect on the application domain, which can be used for phishing.