From 8df023e1448432181a55fedca0a84ecf6cb7718e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mike=20F=C3=A4hrmann?= Date: Tue, 3 Oct 2017 22:38:48 +0200 Subject: [PATCH] [util:filter] re-enable builtins Trying to restrict access to Python's builtin functions (exec, print, __import__, ...) can easily be circumvented and is therefore completely pointless. This also adds 'safe_int()' and the 'datetime' module to the global namespace used when evaluating filter expressions. --- gallery_dl/util.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/gallery_dl/util.py b/gallery_dl/util.py index 2aec93f6..22efdc93 100644 --- a/gallery_dl/util.py +++ b/gallery_dl/util.py @@ -17,6 +17,7 @@ import random import string import _string import hashlib +import datetime import urllib.parse from . import text, exception @@ -195,7 +196,7 @@ class UniquePredicate(): class FilterPredicate(): """Predicate; True if evaluating the given expression returns True""" - globalsdict = {"__builtins__": {}} + globalsdict = {"safe_int": safe_int, "datetime": datetime.datetime} def __init__(self, codeobj): self.codeobj = codeobj