[util:filter] re-enable builtins
Trying to restrict access to Python's builtin functions (exec, print, __import__, ...) can easily be circumvented and is therefore completely pointless. This also adds 'safe_int()' and the 'datetime' module to the global namespace used when evaluating filter expressions.
This commit is contained in:
@@ -17,6 +17,7 @@ import random
|
||||
import string
|
||||
import _string
|
||||
import hashlib
|
||||
import datetime
|
||||
import urllib.parse
|
||||
from . import text, exception
|
||||
|
||||
@@ -195,7 +196,7 @@ class UniquePredicate():
|
||||
|
||||
class FilterPredicate():
|
||||
"""Predicate; True if evaluating the given expression returns True"""
|
||||
globalsdict = {"__builtins__": {}}
|
||||
globalsdict = {"safe_int": safe_int, "datetime": datetime.datetime}
|
||||
|
||||
def __init__(self, codeobj):
|
||||
self.codeobj = codeobj
|
||||
|
||||
Reference in New Issue
Block a user