Home | Trees | Indices | Help |
---|
|
An eval-pseudo-sandbox. The pseudo-sandbox restricts the available functions/objects, so the code can only access: - some of the builtin python-functions, which are considered "safe" (see safe_builtins) - some additional functions (exists(), default(), setvar()) - the passed objects incl. their methods. Additionally, names beginning with "_" are forbidden. This is to prevent things like '0 .__class__', with which you could easily break out of a "sandbox". Be careful to only pass "safe" objects/functions to the template, because any unsafe function/method could break the sandbox! For maximum security, restrict the access to as few objects/functions as possible! :Warning: Note that this is no real sandbox! (And although I don't know any way to break out of the sandbox without passing-in an unsafe object, I cannot guarantee that there is no such way. So use with care.) Take care if you want to use it for untrusted code!!
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|
|||
safe_builtins =
|
|||
safe_builtins_python2 =
|
|
Compile a python-eval-expression. - Use a compile-cache. - Raise a `NameError` if `expr` contains a name beginning with ``_``. :Returns: the compiled `expr` :Exceptions: - `SyntaxError`: for compile-errors - `NameError`: if expr contains a name beginning with ``_`` |
Eval a python-eval-expression. Sets ``self.locals_ptr`` to ``locales`` and compiles the code before evaluating. |
``default()`` for the sandboxed code. Try to evaluate an expression and return the result or a fallback-/default-value; the `default`-value is used if `expr` does not exist/is invalid/results in None. This is very useful for optional data. :Parameter: - expr: eval-expression - default: fallback-falue if eval(expr) fails or is None. :Returns: the eval-result or the "fallback"-value. :Note: the eval-expression has to be quoted! (like in eval) :Example: see module-docstring |
``exists()`` for the sandboxed code. Test if the variable `varname` exists in the current locals-namespace. This only works for single variable names. If you want to test complicated expressions, use i.e. `default`. (i.e. `default("expr",False)`) :Note: the variable-name has to be quoted! (like in eval) :Example: see module-docstring |
``import``/``__import__()`` for the sandboxed code. Since "import" is insecure, the PseudoSandbox does not allow to import other modules. But since some functions need to import other modules (e.g. "datetime.datetime.strftime" imports "time"), this function replaces the builtin "import" and allows to use modules which are already accessible by the sandboxed code. :Note: - This probably only works for rather simple imports. - For security, it may be better to avoid such (complex) modules which import other modules. (e.g. use time.localtime and time.strftime instead of datetime.datetime.strftime) :Example: >>> from datetime import datetime >>> import pyratemp >>> t = pyratemp.Template('@!mytime.strftime("%H:%M:%S")!@') >>> print t(mytime=datetime.now()) Traceback (most recent call last): ... ImportError: import not allowed in pseudo-sandbox; try to import 'time' yourself and pass it to the sandbox/template >>> import time >>> print t(mytime=datetime.strptime("13:40:54", "%H:%M:%S"), time=time) 13:40:54 # >>> print t(mytime=datetime.now(), time=time) # 13:40:54 |
``setvar()`` for the sandboxed code. Set a variable. :Example: see module-docstring |
Add an object to the "allowed eval-globals". Mainly useful to add user-defined functions to the pseudo-sandbox. |
|
safe_builtins
|
safe_builtins_python2
|
Home | Trees | Indices | Help |
---|
Generated by Epydoc 3.0.1 on Mon Nov 24 20:56:15 2014 | http://epydoc.sourceforge.net |