Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def _eval_call(self, node):
if isinstance(node.func, ast.Attribute):
raise simpleeval.FeatureNotAvailable("No methods please, we're British")
return super(EvalNoMethods, self)._eval_call(node)
def test_string_format(self):
# python has so many ways to break out!
with self.assertRaises(simpleeval.FeatureNotAvailable):
self.t('"{string.__class__}".format(string="things")', 0)
with self.assertRaises(simpleeval.FeatureNotAvailable):
self.s.names['x'] = {"a": 1}
self.t('"{a.__class__}".format_map(x)', 0)
if sys.version_info >= (3, 6, 0):
self.s.names['x'] = 42
with self.assertRaises(simpleeval.FeatureNotAvailable):
self.t('f"{x.__class__}"', 0)
self.s.names['x'] = lambda y: y
with self.assertRaises(simpleeval.FeatureNotAvailable):
self.t('f"{x.__globals__}"', 0)
def test_lambda_application(self):
with self.assertRaises(FeatureNotAvailable):
self.t('(lambda x:22)(44)', None)
def _eval_call(self, node):
if isinstance(node.func, ast.Attribute):
func = self._eval(node.func)
else:
try:
func = self.functions[node.func.id]
except KeyError:
raise FunctionNotDefined(node.func.id, self.expr)
except AttributeError as e:
raise FeatureNotAvailable('Lambda Functions not implemented')
if func in DISALLOW_FUNCTIONS:
raise FeatureNotAvailable('This function is forbidden')
return func(
*(self._eval(a) for a in node.args),
**dict(self._eval(k) for k in node.keywords)
)
self.nodes[ast.JoinedStr] = self._eval_joinedstr # f-string
self.nodes[ast.FormattedValue] = self._eval_formattedvalue # formatted value in f-string
# py3.8 uses ast.Constant instead of ast.Num, ast.Str, ast.NameConstant
if hasattr(ast, 'Constant'):
self.nodes[ast.Constant] = self._eval_constant
# Defaults:
self.ATTR_INDEX_FALLBACK = ATTR_INDEX_FALLBACK
# Check for forbidden functions:
for f in self.functions.values():
if f in DISALLOW_FUNCTIONS:
raise FeatureNotAvailable('This function {} is a really bad idea.'.format(f))
def _eval(self, node):
""" The internal evaluator used on each node in the parsed tree. """
try:
handler = self.nodes[type(node)]
except KeyError:
raise FeatureNotAvailable("Sorry, {0} is not available in this "
"evaluator".format(type(node).__name__))
return handler(node)
def _eval_call(self, node):
if isinstance(node.func, ast.Attribute):
func = self._eval(node.func)
else:
try:
func = self.functions[node.func.id]
except KeyError:
raise FunctionNotDefined(node.func.id, self.expr)
except AttributeError as e:
raise FeatureNotAvailable('Lambda Functions not implemented')
if func in DISALLOW_FUNCTIONS:
raise FeatureNotAvailable('This function is forbidden')
return func(
*(self._eval(a) for a in node.args),
**dict(self._eval(k) for k in node.keywords)
)
def _eval_call(self, node):
if isinstance(node.func, ast.Attribute):
raise simpleeval.FeatureNotAvailable("No methods please, we're British")
return super()._eval_call(node)
def _eval_attribute(self, node):
for prefix in DISALLOW_PREFIXES:
if node.attr.startswith(prefix):
raise FeatureNotAvailable(
"Sorry, access to __attributes "
" or func_ attributes is not available. "
"({0})".format(node.attr))
if node.attr in DISALLOW_METHODS:
raise FeatureNotAvailable(
"Sorry, this method is not available. "
"({0})".format(node.attr))
# eval node
node_evaluated = self._eval(node.value)
# Maybe the base object is an actual object, not just a dict
try:
return getattr(node_evaluated, node.attr)
except (AttributeError, TypeError):
pass