Prevent sandbox escape via 'BaseRequest.traverseName'.

Fixes LP #1095343.

doc/CHANGES.rst

@@ -8,6 +8,8 @@ http://docs.zope.org/zope2/
 2.12.28 (unreleased)
 --------------------
 
+- LP #1095343:  prevent sandbox escape via ``BaseRequest.traverseName``.
+
 - LP #1094144:  prevent arbitrary redirections via faked "CANCEL" buttons.
 
 - LP #1094221:  add permissions to some unprotected methods of

src/ZPublisher/BaseRequest.py

@@ -341,6 +341,7 @@ class BaseRequest:
             ob2 = adapter.publishTraverse(self, name)
 
         return ob2
+    traverseName__roles__ = ()
 
     def traverse(self, path, response=None, validated_hook=None):
         """Traverse the object space