Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix unsafe procedures #135

Merged
merged 2 commits into from
Jan 14, 2025
Merged

Fix unsafe procedures #135

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
382a5fe
make all procedure attributes private to curb access to AST nodes, wh…
newville Jan 14, 2025
3ba2d51
add test of accessing procedure attributes
newville Jan 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
90 changes: 45 additions & 45 deletions asteval/astutils.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -506,59 +506,59 @@
self.name = name
self.__name__ = self.name
self.__asteval__ = interp
self.raise_exc = self.__asteval__.raise_exception
self.__raise_exc__ = self.__asteval__.raise_exception
self.__doc__ = doc
self.body = body
self.argnames = args
self.kwargs = kwargs
self.vararg = vararg
self.varkws = varkws
self.__body__ = body
self.__argnames__ = args
self.__kwargs__ = kwargs
self.__vararg__ = vararg
self.__varkws__ = varkws
self.lineno = lineno
self.__ininit__ = False

def __setattr__(self, attr, val):
if not getattr(self, '__ininit__', True):
self.raise_exc(None, exc=TypeError,
self.__raise_exc__(None, exc=TypeError,

Check warning on line 521 in asteval/astutils.py

View check run for this annotation

Codecov / codecov/patch

asteval/astutils.py#L521 

Added line #L521 was not covered by tests
msg="procedure is read-only")
self.__dict__[attr] = val

def __dir__(self):
return ['_getdoc', 'argnames', 'kwargs', 'name', 'vararg', 'varkws']
return ['__getdoc__', '__argnames__', 'kwargs', 'name', 'vararg', 'varkws']

Check warning on line 526 in asteval/astutils.py

View check run for this annotation

Codecov / codecov/patch

asteval/astutils.py#L526 

Added line #L526 was not covered by tests

def _getdoc(self):
def __getdoc__(self):
doc = self.__doc__
if isinstance(doc, ast.Constant):
doc = doc.value
return doc

def __repr__(self):
"""TODO: docstring in magic method."""
sig = self._signature()
"""Procedure repr"""
sig = self.__signature__()
rep = f"<Procedure {sig}>"
doc = self._getdoc()
doc = self.__getdoc__()
if doc is not None:
rep = f"{rep}\n {doc}"
return rep

def _signature(self):
"call signature"
def __signature__(self):
"return the procedure's call signature"
sig = ""
if len(self.argnames) > 0:
sig = sig + ', '.join(self.argnames)
if self.vararg is not None:
sig = sig + f"*{self.vararg}"
if len(self.kwargs) > 0:
if len(self.__argnames__) > 0:
sig = sig + ', '.join(self.__argnames__)
if self.__vararg__ is not None:
sig = sig + f"*{self.__vararg__}"
if len(self.__kwargs__) > 0:
if len(sig) > 0:
sig = f"{sig}, "
_kw = [f"{k}={v}" for k, v in self.kwargs]
_kw = [f"{k}={v}" for k, v in self.__kwargs__]
sig = f"{sig}{', '.join(_kw)}"

if self.varkws is not None:
sig = f"{sig}, **{self.varkws}"
if self.__varkws__ is not None:
sig = f"{sig}, **{self.__varkws__}"
return f"{self.name}({sig})"

def __call__(self, *args, **kwargs):
"""TODO: docstring in public method."""
"""call the Procedure"""
topsym = self.__asteval__.symtable
if self.__asteval__.config.get('nested_symtable', False):
sargs = {'_main': topsym}
Expand All @@ -576,72 +576,72 @@
args = list(args)
nargs = len(args)
nkws = len(kwargs)
nargs_expected = len(self.argnames)
nargs_expected = len(self.__argnames__)

# check for too few arguments, but the correct keyword given
if (nargs < nargs_expected) and nkws > 0:
for name in self.argnames[nargs:]:
for name in self.__argnames__[nargs:]:
if name in kwargs:
args.append(kwargs.pop(name))
nargs = len(args)
nargs_expected = len(self.argnames)
nargs_expected = len(self.__argnames__)
nkws = len(kwargs)
if nargs < nargs_expected:
msg = f"{self.name}() takes at least"
msg = f"{msg} {nargs_expected} arguments, got {nargs}"
self.raise_exc(None, exc=TypeError, msg=msg)
self.__raise_exc__(None, exc=TypeError, msg=msg)
# check for multiple values for named argument
if len(self.argnames) > 0 and kwargs is not None:
if len(self.__argnames__) > 0 and kwargs is not None:
msg = "multiple values for keyword argument"
for targ in self.argnames:
for targ in self.__argnames__:
if targ in kwargs:
msg = f"{msg} '{targ}' in Procedure {self.name}"
self.raise_exc(None, exc=TypeError, msg=msg, lineno=self.lineno)
self.__raise_exc__(None, exc=TypeError, msg=msg, lineno=self.lineno)

Check warning on line 599 in asteval/astutils.py

View check run for this annotation

Codecov / codecov/patch

asteval/astutils.py#L599 

Added line #L599 was not covered by tests

# check more args given than expected, varargs not given
if nargs != nargs_expected:
msg = None
if nargs < nargs_expected:
msg = f"not enough arguments for Procedure {self.name}()"
msg = f"{msg} (expected {nargs_expected}, got {nargs}"
self.raise_exc(None, exc=TypeError, msg=msg)
self.__raise_exc__(None, exc=TypeError, msg=msg)

Check warning on line 607 in asteval/astutils.py

View check run for this annotation

Codecov / codecov/patch

asteval/astutils.py#L607 

Added line #L607 was not covered by tests

if nargs > nargs_expected and self.vararg is None:
if nargs - nargs_expected > len(self.kwargs):
if nargs > nargs_expected and self.__vararg__ is None:
if nargs - nargs_expected > len(self.__kwargs__):
msg = f"too many arguments for {self.name}() expected at most"
msg = f"{msg} {len(self.kwargs)+nargs_expected}, got {nargs}"
self.raise_exc(None, exc=TypeError, msg=msg)
msg = f"{msg} {len(self.__kwargs__)+nargs_expected}, got {nargs}"
self.__raise_exc__(None, exc=TypeError, msg=msg)

for i, xarg in enumerate(args[nargs_expected:]):
kw_name = self.kwargs[i][0]
kw_name = self.__kwargs__[i][0]
if kw_name not in kwargs:
kwargs[kw_name] = xarg

for argname in self.argnames:
for argname in self.__argnames__:
symlocals[argname] = args.pop(0)

try:
if self.vararg is not None:
symlocals[self.vararg] = tuple(args)
if self.__vararg__ is not None:
symlocals[self.__vararg__] = tuple(args)

for key, val in self.kwargs:
for key, val in self.__kwargs__:
if key in kwargs:
val = kwargs.pop(key)
symlocals[key] = val

if self.varkws is not None:
symlocals[self.varkws] = kwargs
if self.__varkws__ is not None:
symlocals[self.__varkws__] = kwargs

elif len(kwargs) > 0:
msg = f"extra keyword arguments for Procedure {self.name}: "
msg = msg + ','.join(list(kwargs.keys()))
self.raise_exc(None, msg=msg, exc=TypeError,
self.__raise_exc__(None, msg=msg, exc=TypeError,
lineno=self.lineno)

except (ValueError, LookupError, TypeError,
NameError, AttributeError):
msg = f"incorrect arguments for Procedure {self.name}"
self.raise_exc(None, msg=msg, lineno=self.lineno)
self.__raise_exc__(None, msg=msg, lineno=self.lineno)

if self.__asteval__.config.get('nested_symtable', False):
save_symtable = self.__asteval__.symtable
Expand All @@ -655,7 +655,7 @@
retval = None

# evaluate script of function
for node in self.body:
for node in self.__body__:
self.__asteval__.run(node, expr='<>', lineno=self.lineno)
if len(self.__asteval__.error) > 0:
break
Expand Down
20 changes: 20 additions & 0 deletions tests/test_asteval.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1568,5 +1568,25 @@ def test_delete_slice(nested):
assert interp("g.dlist") == [1, 3, 5, 7, 15, 17, 19, 21]


@pytest.mark.parametrize("nested", [False, True])
def test_unsafe_procedure_access(nested):
"""
addressing https://github.com/lmfit/asteval/security/advisories/GHSA-vp47-9734-prjw
"""
interp = make_interpreter(nested_symtable=nested)
interp(textwrap.dedent("""
def my_func(x, y):
return x+y

my_func.__body__[0] = 'something else'

"""), raise_errors=False)

error = interp.error[0]
etype, fullmsg = error.get_error()
assert 'no safe attribute' in error.msg
assert etype == 'AttributeError'


if __name__ == '__main__':
pytest.main(['-v', '-x', '-s'])
Loading