Security fix.

This commit is contained in:
Jeremy Fincher 2003-04-11 20:17:35 +00:00
parent b24d360775
commit 04855169e2

View File

@ -32,6 +32,7 @@
from fix import * from fix import *
import re import re
import new
import time import time
import shlex import shlex
import inspect import inspect
@ -153,16 +154,15 @@ class ArgumentError(Error):
pass pass
class Tokenizer: class Tokenizer:
quotes = '"`' _env = {'__builtins__': new.module('__builtins__')}
nonbacktickquotes = '"'
validChars = string.ascii[33:].translate(string.ascii, '"`[]') validChars = string.ascii[33:].translate(string.ascii, '"`[]')
def __init__(self, tokens=''): def __init__(self, tokens=''):
self.validChars = self.validChars.translate(string.ascii, tokens) self.validChars = self.validChars.translate(string.ascii, tokens)
def handleToken(self, token): def handleToken(self, token):
while token and token[0] in self.quotes and token[-1] == token[0]: while token and token[0] == '"' and token[-1] == token[0]:
if len(token) > 1: if len(token) > 1:
token = eval('"%s"' % token[1:-1]) token = eval('"%s"' % token[1:-1], self._env, self._env)
else: else:
break break
return token return token
@ -184,7 +184,7 @@ class Tokenizer:
def tokenize(self, s): def tokenize(self, s):
lexer = shlex.shlex(StringIO(s)) lexer = shlex.shlex(StringIO(s))
lexer.commenters = '' lexer.commenters = ''
lexer.quotes = self.quotes lexer.quotes = '"'
lexer.wordchars = self.validChars lexer.wordchars = self.validChars
args = [] args = []
while True: while True: