3
GgND @ s d Z ddlZddlZddlmZ ddlmZ ddlmZ ddl m
Z
ddl m Z m
Z
ddlmZ dd lmZ dd
lmZ d Ze
red d
dddgZne ZedddgZeddgZeddgZeddgZddlZej dde d d dd lm Z efZ e fZ!e"fZ#y6dd l$m$Z$m%Z% dd l&m&Z& e!e$e%f7 Z!e e&f7 Z W n e'k
rP Y nX ydd!l(m)Z) e e)f7 Z W n e'k
r Y nX dd"lm*Z*m+Z+m,Z, e e*f7 Z e!e+f7 Z!e#e,f7 Z#e e-d#d$d%d&d'd(d)d*gfe!e-d$d'd+d,d*gfe#e-d-d.d/d0d1d(gfe e-d-d2d$d1d3d'd4d(d5g ffZ.G d6d7 d7eZ/d8d9 Z0d:d; Z1dd? Z3G d@dA dAeZ4G dBdC dCe4Z5yddDl6m7Z7 W n e'k
r dEdF Z7Y nX G dGdH dHe8Z9G dIdJ dJe9eZ:G dKdL dLe9eZ;dS )Maj
jinja2.sandbox
~~~~~~~~~~~~~~
Adds a sandbox layer to Jinja as it was the default behavior in the old
Jinja 1 releases. This sandbox is slightly different from Jinja 1 as the
default behavior is easier to use.
The behavior can be changed by subclassing the environment.
:copyright: (c) 2017 by the Jinja Team.
:license: BSD.
N)Mapping)update_wrapper) Environment)
SecurityError) string_typesPY2)Markup)EscapeFormatter) Formatteri Z func_closureZ func_codeZ func_dictZ
func_defaultsZ func_globalsZim_classZim_funcZim_selfgi_framegi_codecr_framecr_codeag_codeag_frameignorezthe sets modulezjinja2.sandbox)module)deque)UserDict DictMixin)UserList)Set)
MutableSetMutableMappingMutableSequenceaddcleardifference_updatediscardpopremovesymmetric_difference_updateupdatepopitem
setdefaultappendreverseinsertsortextend
appendleft
extendleftpopleftrotatec @ s0 e Zd ZdZdd Zdd Zdd Zdd Zd
S ) _MagicFormatMappingzThis class implements a dummy wrapper to fix a bug in the Python
standard library for string formatting.
See https://bugs.python.org/issue13598 for information about why
this is necessary.
c C s || _ || _d| _d S )Nr )_args_kwargs _last_index)selfargskwargs r5 /usr/lib/python3.6/sandbox.py__init__s s z _MagicFormatMapping.__init__c C sN |dkrD| j }| j d7 _ y
| j| S tk
r: Y nX t|}| j| S )N )r1 r/ LookupErrorstrr0 )r2 keyidxr5 r5 r6 __getitem__x s
z _MagicFormatMapping.__getitem__c C s
t | jS )N)iterr0 )r2 r5 r5 r6 __iter__ s z _MagicFormatMapping.__iter__c C s
t | jS )N)lenr0 )r2 r5 r5 r6 __len__ s z_MagicFormatMapping.__len__N)__name__
__module__ __qualname____doc__r7 r> r@ rB r5 r5 r5 r6 r. k s
r. c G s$ t | }t|tkr tdt |S )zWA range that can't generate ranges with a length of more than
MAX_RANGE items.
z+range too big, maximum size for range is %d)rangerA MAX_RANGE
OverflowError)r3 rngr5 r5 r6
safe_range s
rK c C s
d| _ | S )znMarks a function or method as unsafe.
::
@unsafe
def delete(self):
pass
T)unsafe_callable)fr5 r5 r6 unsafe s rN c C s t | tjr|tkrdS nt | tjr<|tks6|tkrdS nt | trT|dkrdS nzt | tjtjtj frndS t | tj
r|t krdS nFt tdrt | tj
r|tkrdS n"t tdrt | tjr|tkrdS |jdS )a Test if the attribute given is an internal python attribute. For
example this function returns `True` for the `func_code` attribute of
python objects. This is useful if the environment method
:meth:`~SandboxedEnvironment.is_safe_attribute` is overridden.
>>> from jinja2.sandbox import is_internal_attribute
>>> is_internal_attribute(str, "mro")
True
>>> is_internal_attribute(str, "upper")
False
Tmro
CoroutineTypeAsyncGeneratorType__)
isinstancetypes FunctionTypeUNSAFE_FUNCTION_ATTRIBUTES
MethodTypeUNSAFE_METHOD_ATTRIBUTEStypeCodeType
TracebackType FrameType
GeneratorTypeUNSAFE_GENERATOR_ATTRIBUTEShasattrrP UNSAFE_COROUTINE_ATTRIBUTESrQ !UNSAFE_ASYNC_GENERATOR_ATTRIBUTES
startswith)objattrr5 r5 r6 is_internal_attribute s,
re c C s( x"t D ]\}}t| |r||kS qW dS )a This function checks if an attribute on a builtin mutable object
(list, dict, set or deque) would modify it if called. It also supports
the "user"-versions of the objects (`sets.Set`, `UserDict.*` etc.) and
with Python 2.6 onwards the abstract base classes `MutableSet`,
`MutableMapping`, and `MutableSequence`.
>>> modifies_known_mutable({}, "clear")
True
>>> modifies_known_mutable({}, "keys")
False
>>> modifies_known_mutable([], "append")
True
>>> modifies_known_mutable([], "index")
False
If called with an unsupported object (such as unicode) `False` is
returned.
>>> modifies_known_mutable("foo", "upper")
False
F)
_mutable_specrS )rc rd ZtypespecrN r5 r5 r6 modifies_known_mutable s
rg c @ s e Zd ZdZdZejejejej ej
ej ej dZ
ejejdZe Ze Zdd Zdd Zd d
Zd d Zd
d Zdd Zdd Zdd Zdd Z dd Z dd Z dS ) SandboxedEnvironmenta The sandboxed environment. It works like the regular environment but
tells the compiler to generate sandboxed code. Additionally subclasses of
this environment may override the methods that tell the runtime what
attributes or functions are safe to access.
If the template tries to access insecure code a :exc:`SecurityError` is
raised. However also other exceptions may occur during the rendering so
the caller has to ensure that all exceptions are caught.
T)+-*/z//z**%)ri rj c C s dS )a Called during template compilation with the name of a unary
operator to check if it should be intercepted at runtime. If this
method returns `True`, :meth:`call_unop` is excuted for this unary
operator. The default implementation of :meth:`call_unop` will use
the :attr:`unop_table` dictionary to perform the operator with the
same logic as the builtin one.
The following unary operators are interceptable: ``+`` and ``-``
Intercepted calls are always slower than the native operator call,
so make sure only to intercept the ones you are interested in.
.. versionadded:: 2.6
Fr5 )r2 operatorr5 r5 r6 intercept_unop" s z#SandboxedEnvironment.intercept_unopc O s8 t j| f|| t| jd< | jj | _| jj | _d S )NrG ) r r7 rK globalsdefault_binop_tablecopy binop_tabledefault_unop_table
unop_table)r2 r3 r4 r5 r5 r6 r7 4 s
z SandboxedEnvironment.__init__c C s |j dpt|| S )aY The sandboxed environment will call this method to check if the
attribute of an object is safe to access. Per default all attributes
starting with an underscore are considered private as well as the
special attributes of internal python objects as returned by the
:func:`is_internal_attribute` function.
_)rb re )r2 rc rd valuer5 r5 r6 is_safe_attribute: s z&SandboxedEnvironment.is_safe_attributec C s t |ddpt |dd S )a Check if an object is safely callable. Per default a function is
considered safe unless the `unsafe_callable` attribute exists and is
True. Override this method to alter the behavior, but this won't
affect the `unsafe` decorator from this module.
rL FZ alters_data)getattr)r2 rc r5 r5 r6 is_safe_callableC s z%SandboxedEnvironment.is_safe_callablec C s | j | ||S )zFor intercepted binary operator calls (:meth:`intercepted_binops`)
this function is executed instead of the builtin operator. This can
be used to fine tune the behavior of certain operators.
.. versionadded:: 2.6
)rs )r2 contextrn leftrightr5 r5 r6
call_binopL s z SandboxedEnvironment.call_binopc C s | j | |S )zFor intercepted unary operator calls (:meth:`intercepted_unops`)
this function is executed instead of the builtin operator. This can
be used to fine tune the behavior of certain operators.
.. versionadded:: 2.6
)ru )r2 r{ rn argr5 r5 r6 call_unopU s z SandboxedEnvironment.call_unopc C s y|| S t tfk
r t|try t|}W n tk
rF Y nZX yt||}W n tk
rj Y n6X | j|}|dk r|S | j |||r|S | j
||S Y nX | j ||dS )z(Subscribe an object from sandboxed code.N)rc name) TypeErrorr: rS r r; Exceptionry AttributeErrorwrap_str_formatrx unsafe_undefined undefined)r2 rc Zargumentrd rw fmtr5 r5 r6 getitem^ s&
z SandboxedEnvironment.getitemc C s yt ||}W n6 tk
rD y|| S ttfk
r> Y nX Y n6X | j|}|dk r\|S | j|||rn|S | j||S | j||dS )zSubscribe an object from sandboxed code and prefer the
attribute. The attribute passed *must* be a bytestring.
N)rc r )ry r r r: r rx r r )r2 rc attributerw r r5 r5 r6 ry v s
z SandboxedEnvironment.getattrc C s | j d||jjf ||tdS )z1Return an undefined object for unsafe attributes.z.access to attribute %r of %r object is unsafe.)r rc exc)r __class__rC r )r2 rc r r5 r5 r6 r s
z%SandboxedEnvironment.unsafe_undefinedc s t |tjtjf s |jdkr"dS |j t ts6dS t |jdkt trbt | j
d}nt | }|j fdd}t
||S )a If the given value is a ``str.format`` or ``str.format_map`` method,
return a new function than handles sandboxing. This is done at access
rather than in :meth:`call`, so that calls made without ``call`` are
also sandboxed.
format
format_mapN)escapec sL r<|rt dt| dkr0t dt| d| d }f } | |S )Nz'format_map() takes no keyword argumentsr9 z)format_map() takes exactly one argument (z given)r )r rA )r3 r4 )f_self
is_format_mapstr_typevformatr5 r6 wrapper s z5SandboxedEnvironment.wrap_str_format..wrapper)r r )rS rT rW BuiltinMethodTyperC __self__r; rY r SandboxedEscapeFormatterr SandboxedFormatterr r )r2 rw Z formatterr r5 )r r r r r6 r s
z$SandboxedEnvironment.wrap_str_formatc O s* | j |std|f |j|f||S )z#Call an object from sandboxed code.z%r is not safely callable)rz r call)Z_SandboxedEnvironment__selfZ _SandboxedEnvironment__contextZ_SandboxedEnvironment__objr3 r4 r5 r5 r6 r s
zSandboxedEnvironment.callN) rC rD rE rF Z sandboxedrn r submultruedivfloordivpowmodrq posnegrt frozensetZintercepted_binopsZintercepted_unopsro r7 rx rz r~ r r ry r r r r5 r5 r5 r6 rh s0
$rh c @ s e Zd ZdZdd ZdS ) ImmutableSandboxedEnvironmentzWorks exactly like the regular `SandboxedEnvironment` but does not
permit modifications on the builtin mutable objects `list`, `set`, and
`dict` by using the :func:`modifies_known_mutable` function.
c C s t j| |||sdS t|| S )NF)rh rx rg )r2 rc rd rw r5 r5 r6 rx s z/ImmutableSandboxedEnvironment.is_safe_attributeN)rC rD rE rF rx r5 r5 r5 r6 r s r )formatter_field_name_splitc C s | j S )N)Z_formatter_field_name_split)
field_namer5 r5 r6 r s r c @ s e Zd Zdd Zdd ZdS )SandboxedFormatterMixinc C s
|| _ d S )N)_env)r2 envr5 r5 r6 r7 s z SandboxedFormatterMixin.__init__c C sV t |\}}| j|||}x2|D ]*\}}|r<| jj||}q | jj||}q W ||fS )N)r Z get_valuer ry r ) r2 r r3 r4 firstrestrc Zis_attrir5 r5 r6 get_field s z!SandboxedFormatterMixin.get_fieldN)rC rD rE r7 r r5 r5 r5 r6 r s r c @ s e Zd Zdd ZdS )r c C s t j| | tj| d S )N)r r7 r
)r2 r r5 r5 r6 r7 s zSandboxedFormatter.__init__N)rC rD rE r7 r5 r5 r5 r6 r s r c @ s e Zd Zdd ZdS )r c C s t j| | tj| | d S )N)r r7 r )r2 r r r5 r5 r6 r7 s z!SandboxedEscapeFormatter.__init__N)rC rD rE r7 r5 r5 r5 r6 r s r ) s
$ _