8234168124

Committed 11 Mar 2024 02:05PM UTC coverage: 81.316% (+0.2%) from 81.124%

Build # 8234168124

Build Type

Pull #147

github

Committed by

web-flow

Commit Message

Merge 3ee0e2593 into 38a89f0f9

Pull Request Pull Request #147: Make dict views behave like their unrestricted versions

Run Details

951 of 1475 branches covered (64.47%)

Branch coverage included in aggregate %.

75 of 76 new or added lines in 3 files covered. (98.68%)

11 existing lines in 1 file now uncovered.

5055 of 5911 relevant lines covered (85.52%)

5.12 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

89.03

/src/AccessControl/ZopeGuards.py

#############################################################################
#
# Copyright (c) 2002 Zope Foundation and Contributors.
#
# This software is subject to the provisions of the Zope Public License,
# Version 2.1 (ZPL).  A copy of the ZPL should accompany this distribution.
# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY AND ALL EXPRESS OR IMPLIED
# WARRANTIES ARE DISCLAIMED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
# WARRANTIES OF TITLE, MERCHANTABILITY, AGAINST INFRINGEMENT, AND FITNESS
# FOR A PARTICULAR PURPOSE
#
##############################################################################


import collections.abc
import math
import random
import string
from functools import reduce

import RestrictedPython
from RestrictedPython.Eval import RestrictionCapableEval
from RestrictedPython.Guards import full_write_guard
from RestrictedPython.Guards import guarded_iter_unpack_sequence
from RestrictedPython.Guards import guarded_unpack_sequence
from RestrictedPython.Guards import safe_builtins
from RestrictedPython.Utilities import utility_builtins
from zExceptions import Unauthorized

from AccessControl.SecurityInfo import ModuleSecurityInfo
from AccessControl.SecurityInfo import secureModule
from AccessControl.SecurityManagement import getSecurityManager
from AccessControl.SimpleObjectPolicies import ContainerAssertions
from AccessControl.SimpleObjectPolicies import Containers
from AccessControl.SimpleObjectPolicies import allow_type


_marker = []  # Create a new marker object.

safe_builtins = safe_builtins.copy()
safe_builtins.update(utility_builtins)

# Allow access to unprotected attributes
string.__allow_access_to_unprotected_subobjects__ = 1
math.__allow_access_to_unprotected_subobjects__ = 1
random.__allow_access_to_unprotected_subobjects__ = 1

# Mark some unprotected module attributes as private, these should not be
# used in untrusted Python code such as Scripts (Python)
string_modsec = ModuleSecurityInfo('string')
for name in ('Formatter', 'Template'):
    string_modsec.declarePrivate(name)  # NOQA: D001
secureModule('string')

# AccessControl.Implementation inserts these names into this module as
# module globals:  aq_validate, guarded_getattr


def initialize(impl):
    # Called by AccessControl.Implementation.setImplementation()
    # whenever the selected implementation changes.
    global guarded_getattr
    guarded_getattr = impl.guarded_getattr
    safe_builtins['getattr'] = guarded_getattr
    _safe_globals['_getattr_'] = guarded_getattr


def guarded_hasattr(object, name):
    try:
        guarded_getattr(object, name)
    except (AttributeError, Unauthorized, TypeError):
        return 0
    return 1


safe_builtins['hasattr'] = guarded_hasattr


SliceType = type(slice(0))


def guarded_getitem(object, index):
    if isinstance(index, SliceType):
        if index.step is not None:
            v = object[index]
        else:
            start = index.start
            stop = index.stop
            if start is None:
                start = 0
            if stop is None:
                v = object[start:]
            else:
                v = object[start:stop]
        # We don't guard slices.
        return v
    v = object[index]
    if Containers(type(object)) and Containers(type(v)):
        # Simple type.  Short circuit.
        return v
    if getSecurityManager().validate(object, object, None, v):
        return v
    raise Unauthorized('unauthorized access to element %s' % index)


# Create functions using nested scope to store state
# This is less expensive then instantiating and calling instances
def get_dict_get(d, name):
    def guarded_get(key, default=None):
        try:
            return guarded_getitem(d, key)
        except KeyError:
            return default
    return guarded_get


def get_dict_pop(d, name):
    def guarded_pop(key, default=_marker):
        try:
            v = guarded_getitem(d, key)
        except KeyError:
            if default is not _marker:
                return default
            raise
        else:
            del d[key]
            return v
    return guarded_pop


def get_mapping_view(c, name):

    view_class = {
        'keys': SafeKeysView,
        'items': SafeItemsView,
        'values': SafeValuesView,
    }

    def guarded_mapping_view():
        return view_class[name](c)

    return guarded_mapping_view


def get_list_pop(lst, name):
    def guarded_pop(index=-1):
        # XXX This is not thread safe, but we don't expect
        # XXX thread interactions between python scripts <wink>
        v = guarded_getitem(lst, index)
        del lst[index]
        return v
    return guarded_pop


# See comment in SimpleObjectPolicies for an explanation of what the
# dicts below actually mean.
_dict_white_list = {
    'clear': 1,
    'copy': 1,
    'fromkeys': 1,
    'get': get_dict_get,
    'items': get_mapping_view,
    'keys': get_mapping_view,
    'pop': get_dict_pop,
    'popitem': 1,
    'setdefault': 1,
    'update': 1,
    'values': get_mapping_view,
}


def _check_dict_access(name, value):
    # Check whether value is a dict method
    self = getattr(value, '__self__', None)
    if self is None:  # item
        return 1
    # Disallow spoofing
    if not isinstance(self, dict):
        return 0
    if getattr(value, '__name__', None) != name:
        return 0
    return _dict_white_list.get(name, 0)


ContainerAssertions[type({})] = _check_dict_access


# Allow iteration over the result of `dict.{keys, values, items}`
d = {}
for attr in ("keys", "values", "items"):
    allow_type(type(getattr(d, attr)()))


_list_white_list = {
    'append': 1,
    'count': 1,
    'extend': 1,
    'index': 1,
    'insert': 1,
    'pop': get_list_pop,
    'remove': 1,
    'reverse': 1,
    'sort': 1,
}


def _check_list_access(name, value):
    # Check whether value is a dict method
    self = getattr(value, '__self__', None)
    if self is None:  # item
        return 1
    # Disallow spoofing
    if not isinstance(self, list):
        return 0
    if getattr(value, '__name__', None) != name:
        return 0
    return _list_white_list.get(name, 0)


ContainerAssertions[type([])] = _check_list_access


# This implementation of a "safe" iterator uses a global guard()
# function to implement the actual guard.  This check is defined as a
# global so that it can delay imports of some module to avoid circular
# dependencies while also making it possible to use a faster
# implementation once the imports are done (by avoiding the import
# machinery on subsequent calls).  Use of a method on the SafeIter
# class is avoided to ensure the best performance of the resulting
# function.
# The NullIter class skips the guard, and can be used to wrap an
# iterator that is known to be safe (as in guarded_enumerate).


def guarded_next(iterator, default=_marker):
    if default is _marker:
        ob = next(iterator)
    else:
        ob = next(iterator, default)
    if not isinstance(iterator, SafeIter):
        guard(ob, ob)
    return ob


safe_builtins['next'] = guarded_next


class SafeIter:
    __allow_access_to_unprotected_subobjects__ = 1

    def __init__(self, ob, container=None):
        self._iter = iter(ob)
        if container is None:
            container = ob
        self.container = container

    def __iter__(self):
        return self

    def __next__(self):
        ob = next(self._iter)
        guard(self.container, ob)
        return ob

    next = __next__


class NullIter(SafeIter):
    def __init__(self, ob):
        self._iter = ob

    def __next__(self):
        return next(self._iter)

    next = __next__


class _SafeMappingView:
    __allow_access_to_unprotected_subobjects__ = 1

    def __iter__(self):
        for e in super().__iter__():
            guard(self._mapping, e)
            yield e


class SafeKeysView(_SafeMappingView, collections.abc.KeysView):
    pass


class SafeValuesView(_SafeMappingView, collections.abc.ValuesView):
    pass


class SafeItemsView(_SafeMappingView, collections.abc.ItemsView):
    def __iter__(self):
        for k, v in super().__iter__():
            guard(self._mapping, k)
            # When checking the value, we check the guard with index=None,
            # not with index=k, the key name does not matter. guard just
            # needs to verify that the value itself can be accessed.
            guard(self._mapping, v)
            yield k, v


def _error(index):
    raise Unauthorized('unauthorized access to element')


def guarded_iter(*args):
    if len(args) == 1:
        i = args[0]
        # Don't double-wrap
        if isinstance(i, SafeIter):
            return i
        if not isinstance(i, range):
            return SafeIter(i)
    # Other call styles / targets don't need to be guarded
    return NullIter(iter(*args))


safe_builtins['iter'] = guarded_iter


def guard(container, value, index=None):
    if Containers(type(container)) and Containers(type(value)):
        # Simple type.  Short circuit.
        return
    if getSecurityManager().validate(container, container, index, value):
        return
    _error(index)

# More replacement built-ins.


def guarded_filter(f, seq, skip_unauthorized=0):
    if isinstance(seq, str):
        return filter(f, seq)

    if f is None:
        def f(x):
            return x

    v = getSecurityManager().validate
    result = []
    a = result.append
    for el in seq:
        if v(seq, seq, None, el):
            if f(el):
                a(el)
        elif not skip_unauthorized:
            raise Unauthorized('unauthorized access to element')
    return result


safe_builtins['filter'] = guarded_filter


def guarded_reduce(f, seq, initial=_marker):
    if initial is _marker:
        return reduce(f, guarded_iter(seq))
    else:
        return reduce(f, guarded_iter(seq), initial)


safe_builtins['reduce'] = guarded_reduce


def guarded_max(item, *items, **kw):
    if items:
        item = [item]
        item.extend(items)
    return max(guarded_iter(item), **kw)


safe_builtins['max'] = guarded_max


def guarded_min(item, *items, **kw):
    if items:
        item = [item]
        item.extend(items)
    return min(guarded_iter(item), **kw)


safe_builtins['min'] = guarded_min


def guarded_map(f, *seqs):
    safe_seqs = []
    for seqno in range(len(seqs)):
        seq = guarded_getitem(seqs, seqno)
        safe_seqs.append(guarded_iter(seq))
    return list(map(f, *safe_seqs))


safe_builtins['map'] = guarded_map


def guarded_zip(*seqs):
    safe_seqs = []
    for seqno in range(len(seqs)):
        seq = guarded_getitem(seqs, seqno)
        safe_seqs.append(guarded_iter(seq))
    return list(zip(*safe_seqs))


safe_builtins['zip'] = guarded_zip


import_default_level = 0


def guarded_import(mname, globals=None, locals=None, fromlist=None,
                   level=import_default_level):
    if fromlist is None:
        fromlist = ()
    if globals is None:
        globals = {}
    if locals is None:
        locals = {}
    # Refs https://bugs.launchpad.net/zope2/+bug/659968
    if level != import_default_level:
        raise Unauthorized("Using import with a level specification isn't "
                           "supported by AccessControl: %s" % mname)

    mnameparts = mname.split('.')
    validate = getSecurityManager().validate
    module = load_module(None, None, mnameparts, validate, globals, locals)
    if module is None:
        raise Unauthorized("import of '%s' is unauthorized" % mname)
    for name in fromlist:
        v = getattr(module, name, None)
        if v is None:
            v = load_module(module, mname, [name], validate,
                            globals, locals)
        if not validate(module, module, name, v):
            raise Unauthorized
    else:
        return __import__(mname, globals, locals, fromlist)


safe_builtins['__import__'] = guarded_import


class GuardedListType:
    def __call__(self, *args, **kwargs):
        return list(*args, **kwargs)

    def sorted(self, iterable, cmp=None, key=None, reverse=False):
        return list.sorted(iterable, cmp=None, key=None, reverse=False)


safe_builtins['list'] = GuardedListType()


class GuardedDictType:
    def __call__(self, *args, **kwargs):
        return dict(*args, **kwargs)

    def fromkeys(self, S, v=None):
        return dict.fromkeys(S, v)


safe_builtins['dict'] = GuardedDictType()


def guarded_enumerate(seq):
    return NullIter(enumerate(guarded_iter(seq)))


safe_builtins['enumerate'] = guarded_enumerate


def guarded_sum(sequence, start=0):
    return sum(guarded_iter(sequence), start)


safe_builtins['sum'] = guarded_sum


def load_module(module, mname, mnameparts, validate, globals, locals):
    while mnameparts:
        nextname = mnameparts.pop(0)
        if mname is None:
            mname = nextname
        else:
            mname = '{}.{}'.format(mname, nextname)
        # import (if not already imported) and  check for MSI
        nextmodule = secureModule(mname, globals, locals)
        if nextmodule is None:  # not allowed
            return
        if module and not validate(module, module, nextname, nextmodule):
            return
        module = nextmodule
    return module


# This version of apply is used by restricted Python, which transforms
# extended call syntax into a call of _apply_(), after tucking the callable
# into the first element of args.  For example,
#     f(3, eggs=1, spam=False)
# is changed to
#     _apply_(f, 3, eggs=1, spam=False)
def guarded_apply(func, *args, **kws):
    return builtin_guarded_apply(func, args, kws)


# This version is the safe_builtins apply() replacement, so needs to match the
# signature of __builtin__.apply.
def builtin_guarded_apply(func, args=(), kws={}):
    # Check the args elements.  args may be an arbitrary iterable, and
    # iterating over it may consume it, so we also need to save away
    # the arguments in a new list to pass on to the real apply().
    i, arglist = 0, []
    for elt in args:
        guard(args, elt, i)
        arglist.append(elt)
        i += 1
    # Check kws similarly.  Checking the keys may not be strictly necessary,
    # but better safe than sorry.  A new argument dict is created just in
    # case kws is a hostile user-defined instance that may do horrid things
    # as a side-effect of calling items().
    argdict = {}
    for k, v in kws.items():
        guard(kws, k)
        guard(kws, v, k)
        argdict[k] = v
    return func(*arglist, **argdict)


safe_builtins['apply'] = builtin_guarded_apply


def guarded_any(seq):
    return any(guarded_iter(seq))


safe_builtins['any'] = guarded_any


def guarded_all(seq):
    return all(guarded_iter(seq))


safe_builtins['all'] = guarded_all


# This metaclass supplies the security declarations that allow all
# attributes of a class and its instances to be read and written.
def _metaclass(name, bases, dict):
    for k, v in dict.items():
        if k.endswith('__roles__') and k[:len('__roles__')] not in dict:
            raise Unauthorized("Can't override security: %s" % k)
    ob = type(name, bases, dict)
    ob.__allow_access_to_unprotected_subobjects__ = 1
    ob._guarded_writes = 1
    return ob


valid_inplace_types = (list, set)


inplace_slots = {
    '+=': '__iadd__',
    '-=': '__isub__',
    '*=': '__imul__',
    '/=': (1 / 2 == 0) and '__idiv__' or '__itruediv__',
    '//=': '__ifloordiv__',
    '%=': '__imod__',
    '**=': '__ipow__',
    '<<=': '__ilshift__',
    '>>=': '__irshift__',
    '&=': '__iand__',
    '^=': '__ixor__',
    '|=': '__ior__',
}


def __iadd__(x, y):
    x += y
    return x


def __isub__(x, y):
    x -= y
    return x


def __imul__(x, y):
    x *= y
    return x


def __idiv__(x, y):
    x /= y
    return x


def __ifloordiv__(x, y):
    x //= y
    return x


def __imod__(x, y):
    x %= y
    return x


def __ipow__(x, y):
    x **= y
    return x


def __ilshift__(x, y):
    x <<= y
    return x


def __irshift__(x, y):
    x >>= y
    return x


def __iand__(x, y):
    x &= y
    return x


def __ixor__(x, y):
    x ^= y
    return x


def __ior__(x, y):
    x |= y
    return x


inplace_ops = {
    '+=': __iadd__,
    '-=': __isub__,
    '*=': __imul__,
    '/=': __idiv__,
    '//=': __ifloordiv__,
    '%=': __imod__,
    '**=': __ipow__,
    '<<=': __ilshift__,
    '>>=': __irshift__,
    '&=': __iand__,
    '^=': __ixor__,
    '|=': __ior__,
}


def protected_inplacevar(op, var, expr):
    """Do an inplace operation

    If the var has an inplace slot, then disallow the operation
    unless the var an instance of ``valid_inplace_types``.
    """
    if hasattr(var, inplace_slots[op]) and \
       not isinstance(var, valid_inplace_types):
        try:
            cls = var.__class__
        except AttributeError:
            cls = type(var)
        raise TypeError(
            "Augmented assignment to %s objects is not allowed"
            " in untrusted code" % cls.__name__)
    return inplace_ops[op](var, expr)


# AccessControl clients generally need to set up a safe globals dict for
# use by restricted code.  The get_safe_globals() function returns such
# a dict, containing '__builtins__' mapped to our safe bulitins, and
# bindings for all the special functions inserted into Python code by
# RestrictionMutator transformations.  A client may wish to add more
# bindings to this dict.  It's generally safe to do so, as
# get_safe_globals returns a (shallow) copy of a canonical safe globals
# dict.
# Exception:  For obscure technical reasons, clients have to import
# guarded_getattr from this module (ZopeGuards) and plug it into the
# dict themselves, with key '_getattr_'.
_safe_globals = {
    '__builtins__': safe_builtins,
    '__metaclass__': _metaclass,
    '_apply_': guarded_apply,
    '_getitem_': guarded_getitem,
    '_getiter_': guarded_iter,
    '_iter_unpack_sequence_': guarded_iter_unpack_sequence,
    '_unpack_sequence_': guarded_unpack_sequence,
    '_print_': RestrictedPython.PrintCollector,
    '_write_': full_write_guard,
    '_inplacevar_': protected_inplacevar,
    # The correct implementation of _getattr_, aka
    # guarded_getattr, isn't known until
    # AccessControl.Implementation figures that out, then
    # stuffs it into *this* module's globals bound to
    # 'guarded_getattr'.  We can't know what that is at
    # '_getattr_': guarded_getattr,
}

get_safe_globals = _safe_globals.copy

RestrictionCapableEval.globals.update(_safe_globals)

1	#############################################################################
2	#
3	# Copyright (c) 2002 Zope Foundation and Contributors.
4	#
5	# This software is subject to the provisions of the Zope Public License,
6	# Version 2.1 (ZPL). A copy of the ZPL should accompany this distribution.
7	# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY AND ALL EXPRESS OR IMPLIED
8	# WARRANTIES ARE DISCLAIMED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
9	# WARRANTIES OF TITLE, MERCHANTABILITY, AGAINST INFRINGEMENT, AND FITNESS
10	# FOR A PARTICULAR PURPOSE
11	#
12	##############################################################################
13
14
15	import collections.abc	6✔
16	import math	6✔
17	import random	6✔
18	import string	6✔
19	from functools import reduce	6✔
20
21	import RestrictedPython	6✔
22	from RestrictedPython.Eval import RestrictionCapableEval	6✔
23	from RestrictedPython.Guards import full_write_guard	6✔
24	from RestrictedPython.Guards import guarded_iter_unpack_sequence	6✔
25	from RestrictedPython.Guards import guarded_unpack_sequence	6✔
26	from RestrictedPython.Guards import safe_builtins	6✔
27	from RestrictedPython.Utilities import utility_builtins	6✔
28	from zExceptions import Unauthorized	6✔
29
30	from AccessControl.SecurityInfo import ModuleSecurityInfo	6✔
31	from AccessControl.SecurityInfo import secureModule	6✔
32	from AccessControl.SecurityManagement import getSecurityManager	6✔
33	from AccessControl.SimpleObjectPolicies import ContainerAssertions	6✔
34	from AccessControl.SimpleObjectPolicies import Containers	6✔
35	from AccessControl.SimpleObjectPolicies import allow_type	6✔
36
37
38	_marker = [] # Create a new marker object.	6✔
39
40	safe_builtins = safe_builtins.copy()	6✔
41	safe_builtins.update(utility_builtins)	6✔
42
43	# Allow access to unprotected attributes
44	string.__allow_access_to_unprotected_subobjects__ = 1	6✔
45	math.__allow_access_to_unprotected_subobjects__ = 1	6✔
46	random.__allow_access_to_unprotected_subobjects__ = 1	6✔
47
48	# Mark some unprotected module attributes as private, these should not be
49	# used in untrusted Python code such as Scripts (Python)
50	string_modsec = ModuleSecurityInfo('string')	6✔
51	for name in ('Formatter', 'Template'):	6✔
52	string_modsec.declarePrivate(name) # NOQA: D001	6✔
53	secureModule('string')	6✔
54
55	# AccessControl.Implementation inserts these names into this module as
56	# module globals: aq_validate, guarded_getattr
57
58
59	def initialize(impl):	6✔
60	# Called by AccessControl.Implementation.setImplementation()
61	# whenever the selected implementation changes.
62	global guarded_getattr
63	guarded_getattr = impl.guarded_getattr	6✔
64	safe_builtins['getattr'] = guarded_getattr	6✔
65	_safe_globals['_getattr_'] = guarded_getattr	6✔
66
67
68	def guarded_hasattr(object, name):	6✔
69	try:	6✔
70	guarded_getattr(object, name)	6✔
71	except (AttributeError, Unauthorized, TypeError):	6✔
72	return 0	6✔
73	return 1	6✔
74
75
76	safe_builtins['hasattr'] = guarded_hasattr	6✔
77
78
79	SliceType = type(slice(0))	6✔
80
81
82	def guarded_getitem(object, index):	6✔
83	if isinstance(index, SliceType):	6!
84	if index.step is not None:	×
85	v = object[index]	×
86	else:
87	start = index.start	×
88	stop = index.stop	×
89	if start is None:	×
90	start = 0	×
91	if stop is None:	×
92	v = object[start:]	×
93	else:
94	v = object[start:stop]	×
95	# We don't guard slices.
96	return v	×
97	v = object[index]	6✔
98	if Containers(type(object)) and Containers(type(v)):	6✔
99	# Simple type. Short circuit.
100	return v	6✔
101	if getSecurityManager().validate(object, object, None, v):	6!
102	return v	6✔
103	raise Unauthorized('unauthorized access to element %s' % index)	×
104
105
106	# Create functions using nested scope to store state
107	# This is less expensive then instantiating and calling instances
108	def get_dict_get(d, name):	6✔
109	def guarded_get(key, default=None):	6✔
110	try:	6✔
111	return guarded_getitem(d, key)	6✔
112	except KeyError:	6✔
113	return default	6✔
114	return guarded_get	6✔
115
116
117	def get_dict_pop(d, name):	6✔
118	def guarded_pop(key, default=_marker):	6✔
119	try:	6✔
120	v = guarded_getitem(d, key)	6✔
121	except KeyError:	6✔
122	if default is not _marker:	6✔
123	return default	6✔
124	raise	6✔
125	else:
126	del d[key]	6✔
127	return v	6✔
128	return guarded_pop	6✔
129
130
131	def get_mapping_view(c, name):	6✔
132
133	view_class = {	6✔
134	'keys': SafeKeysView,
135	'items': SafeItemsView,
136	'values': SafeValuesView,
137	}
138
139	def guarded_mapping_view():	6✔
140	return view_class[name](c)	6✔
141
142	return guarded_mapping_view	6✔
143
144
145	def get_list_pop(lst, name):	6✔
146	def guarded_pop(index=-1):	6✔
147	# XXX This is not thread safe, but we don't expect
148	# XXX thread interactions between python scripts <wink>
149	v = guarded_getitem(lst, index)	6✔
150	del lst[index]	6✔
151	return v	6✔
152	return guarded_pop	6✔
153
154
155	# See comment in SimpleObjectPolicies for an explanation of what the
156	# dicts below actually mean.
157	_dict_white_list = {	6✔
158	'clear': 1,
159	'copy': 1,
160	'fromkeys': 1,
161	'get': get_dict_get,
162	'items': get_mapping_view,
163	'keys': get_mapping_view,
164	'pop': get_dict_pop,
165	'popitem': 1,
166	'setdefault': 1,
167	'update': 1,
168	'values': get_mapping_view,
169	}
170
171
172	def _check_dict_access(name, value):	6✔
173	# Check whether value is a dict method
174	self = getattr(value, '__self__', None)	6✔
175	if self is None: # item	6✔
176	return 1	6✔
177	# Disallow spoofing
178	if not isinstance(self, dict):	6!
179	return 0	×
180	if getattr(value, '__name__', None) != name:	6!
181	return 0	×
182	return _dict_white_list.get(name, 0)	6✔
183
184
185	ContainerAssertions[type({})] = _check_dict_access	6✔
186
187
188	# Allow iteration over the result of `dict.{keys, values, items}`
189	d = {}	6✔
190	for attr in ("keys", "values", "items"):	6✔
191	allow_type(type(getattr(d, attr)()))	6✔
192
193
194	_list_white_list = {	6✔
195	'append': 1,
196	'count': 1,
197	'extend': 1,
198	'index': 1,
199	'insert': 1,
200	'pop': get_list_pop,
201	'remove': 1,
202	'reverse': 1,
203	'sort': 1,
204	}
205
206
207	def _check_list_access(name, value):	6✔
208	# Check whether value is a dict method
209	self = getattr(value, '__self__', None)	6✔
210	if self is None: # item	6✔
211	return 1	6✔
212	# Disallow spoofing
213	if not isinstance(self, list):	6!
214	return 0	×
215	if getattr(value, '__name__', None) != name:	6!
216	return 0	×
217	return _list_white_list.get(name, 0)	6✔
218
219
220	ContainerAssertions[type([])] = _check_list_access	6✔
221
222
223	# This implementation of a "safe" iterator uses a global guard()
224	# function to implement the actual guard. This check is defined as a
225	# global so that it can delay imports of some module to avoid circular
226	# dependencies while also making it possible to use a faster
227	# implementation once the imports are done (by avoiding the import
228	# machinery on subsequent calls). Use of a method on the SafeIter
229	# class is avoided to ensure the best performance of the resulting
230	# function.
231	# The NullIter class skips the guard, and can be used to wrap an
232	# iterator that is known to be safe (as in guarded_enumerate).
233
234
235	def guarded_next(iterator, default=_marker):	6✔
236	if default is _marker:	6✔
237	ob = next(iterator)	6✔
238	else:
239	ob = next(iterator, default)	6✔
240	if not isinstance(iterator, SafeIter):	6✔
241	guard(ob, ob)	6✔
242	return ob	6✔
243
244
245	safe_builtins['next'] = guarded_next	6✔
246
247
248	class SafeIter:	6✔
249	__allow_access_to_unprotected_subobjects__ = 1	6✔
250
251	def __init__(self, ob, container=None):	6✔
252	self._iter = iter(ob)	6✔
253	if container is None:	6✔
254	container = ob	6✔
255	self.container = container	6✔
256
257	def __iter__(self):	6✔
258	return self	6✔
259
260	def __next__(self):	6✔
261	ob = next(self._iter)	6✔
262	guard(self.container, ob)	6✔
263	return ob	6✔
264
265	next = __next__	6✔
266
267
268	class NullIter(SafeIter):	6✔
269	def __init__(self, ob):	6✔
270	self._iter = ob	6✔
271
272	def __next__(self):	6✔
273	return next(self._iter)	6✔
274
275	next = __next__	6✔
276
277
278	class _SafeMappingView:	6✔
279	__allow_access_to_unprotected_subobjects__ = 1	6✔
280
281	def __iter__(self):	6✔
282	for e in super().__iter__():	6✔
283	guard(self._mapping, e)	6✔
284	yield e	6✔
285
286
287	class SafeKeysView(_SafeMappingView, collections.abc.KeysView):	6✔
288	pass	6✔
289
290
291	class SafeValuesView(_SafeMappingView, collections.abc.ValuesView):	6✔
292	pass	6✔
293
294
295	class SafeItemsView(_SafeMappingView, collections.abc.ItemsView):	6✔
296	def __iter__(self):	6✔
297	for k, v in super().__iter__():	6✔
298	guard(self._mapping, k)	6✔
299	# When checking the value, we check the guard with index=None,
300	# not with index=k, the key name does not matter. guard just
301	# needs to verify that the value itself can be accessed.
302	guard(self._mapping, v)	6✔
303	yield k, v	6✔
304
305
306	def _error(index):	6✔
NEW 307	raise Unauthorized('unauthorized access to element')	×
308
309
310	def guarded_iter(*args):	6✔
311	if len(args) == 1:	6!
312	i = args[0]	6✔
313	# Don't double-wrap
314	if isinstance(i, SafeIter):	6✔
315	return i	6✔
316	if not isinstance(i, range):	6✔
317	return SafeIter(i)	6✔
318	# Other call styles / targets don't need to be guarded
319	return NullIter(iter(*args))	6✔
320
321
322	safe_builtins['iter'] = guarded_iter	6✔
323
324
325	def guard(container, value, index=None):	6✔
326	if Containers(type(container)) and Containers(type(value)):	6✔
327	# Simple type. Short circuit.
328	return	6✔
329	if getSecurityManager().validate(container, container, index, value):	6!
330	return	6✔
UNCOV 331	_error(index)	×
332
333	# More replacement built-ins.
334
335
336	def guarded_filter(f, seq, skip_unauthorized=0):	6✔
337	if isinstance(seq, str):	6!
UNCOV 338	return filter(f, seq)	×
339
340	if f is None:	6!
341	def f(x):	6✔
342	return x	6✔
343
344	v = getSecurityManager().validate	6✔
345	result = []	6✔
346	a = result.append	6✔
347	for el in seq:	6✔
348	if v(seq, seq, None, el):	6!
349	if f(el):	6✔
350	a(el)	6✔
UNCOV 351	elif not skip_unauthorized:	×
UNCOV 352	raise Unauthorized('unauthorized access to element')	×
353	return result	6✔
354
355
356	safe_builtins['filter'] = guarded_filter	6✔
357
358
359	def guarded_reduce(f, seq, initial=_marker):	6✔
360	if initial is _marker:	6!
UNCOV 361	return reduce(f, guarded_iter(seq))	×
362	else:
363	return reduce(f, guarded_iter(seq), initial)	6✔
364
365
366	safe_builtins['reduce'] = guarded_reduce	6✔
367
368
369	def guarded_max(item, items, *kw):	6✔
370	if items:	6✔
371	item = [item]	6✔
372	item.extend(items)	6✔
373	return max(guarded_iter(item), **kw)	6✔
374
375
376	safe_builtins['max'] = guarded_max	6✔
377
378
379	def guarded_min(item, items, *kw):	6✔
380	if items:	6✔
381	item = [item]	6✔
382	item.extend(items)	6✔
383	return min(guarded_iter(item), **kw)	6✔
384
385
386	safe_builtins['min'] = guarded_min	6✔
387
388
389	def guarded_map(f, *seqs):	6✔
390	safe_seqs = []	6✔
391	for seqno in range(len(seqs)):	6✔
392	seq = guarded_getitem(seqs, seqno)	6✔
393	safe_seqs.append(guarded_iter(seq))	6✔
394	return list(map(f, *safe_seqs))	6✔
395
396
397	safe_builtins['map'] = guarded_map	6✔
398
399
400	def guarded_zip(*seqs):	6✔
401	safe_seqs = []	6✔
402	for seqno in range(len(seqs)):	6✔
403	seq = guarded_getitem(seqs, seqno)	6✔
404	safe_seqs.append(guarded_iter(seq))	6✔
405	return list(zip(*safe_seqs))	6✔
406
407
408	safe_builtins['zip'] = guarded_zip	6✔
409
410
411	import_default_level = 0	6✔
412
413
414	def guarded_import(mname, globals=None, locals=None, fromlist=None,	6✔
415	level=import_default_level):
416	if fromlist is None:	6✔
417	fromlist = ()	6✔
418	if globals is None:	6✔
419	globals = {}	6✔
420	if locals is None:	6!
421	locals = {}	6✔
422	# Refs https://bugs.launchpad.net/zope2/+bug/659968
423	if level != import_default_level:	6✔
424	raise Unauthorized("Using import with a level specification isn't "	6✔
425	"supported by AccessControl: %s" % mname)
426
427	mnameparts = mname.split('.')	6✔
428	validate = getSecurityManager().validate	6✔
429	module = load_module(None, None, mnameparts, validate, globals, locals)	6✔
430	if module is None:	6✔
431	raise Unauthorized("import of '%s' is unauthorized" % mname)	6✔
432	for name in fromlist:	6✔
433	v = getattr(module, name, None)	6✔
434	if v is None:	6✔
435	v = load_module(module, mname, [name], validate,	6✔
436	globals, locals)
437	if not validate(module, module, name, v):	6!
UNCOV 438	raise Unauthorized	×
439	else:
440	return __import__(mname, globals, locals, fromlist)	6✔
441
442
443	safe_builtins['__import__'] = guarded_import	6✔
444
445
446	class GuardedListType:	6✔
447	def __call__(self, args, *kwargs):	6✔
448	return list(args, *kwargs)	6✔
449
450	def sorted(self, iterable, cmp=None, key=None, reverse=False):	6✔
UNCOV 451	return list.sorted(iterable, cmp=None, key=None, reverse=False)	×
452
453
454	safe_builtins['list'] = GuardedListType()	6✔
455
456
457	class GuardedDictType:	6✔
458	def __call__(self, args, *kwargs):	6✔
459	return dict(args, *kwargs)	6✔
460
461	def fromkeys(self, S, v=None):	6✔
462	return dict.fromkeys(S, v)	6✔
463
464
465	safe_builtins['dict'] = GuardedDictType()	6✔
466
467
468	def guarded_enumerate(seq):	6✔
469	return NullIter(enumerate(guarded_iter(seq)))	6✔
470
471
472	safe_builtins['enumerate'] = guarded_enumerate	6✔
473
474
475	def guarded_sum(sequence, start=0):	6✔
476	return sum(guarded_iter(sequence), start)	6✔
477
478
479	safe_builtins['sum'] = guarded_sum	6✔
480
481
482	def load_module(module, mname, mnameparts, validate, globals, locals):	6✔
483	while mnameparts:	6✔
484	nextname = mnameparts.pop(0)	6✔
485	if mname is None:	6✔
486	mname = nextname	6✔
487	else:
488	mname = '{}.{}'.format(mname, nextname)	6✔
489	# import (if not already imported) and check for MSI
490	nextmodule = secureModule(mname, globals, locals)	6✔
491	if nextmodule is None: # not allowed	6✔
492	return	6✔
493	if module and not validate(module, module, nextname, nextmodule):	6!
UNCOV 494	return	×
495	module = nextmodule	6✔
496	return module	6✔
497
498
499	# This version of apply is used by restricted Python, which transforms
500	# extended call syntax into a call of _apply_(), after tucking the callable
501	# into the first element of args. For example,
502	# f(3, eggs=1, spam=False)
503	# is changed to
504	# _apply_(f, 3, eggs=1, spam=False)
505	def guarded_apply(func, args, *kws):	6✔
506	return builtin_guarded_apply(func, args, kws)	6✔
507
508
509	# This version is the safe_builtins apply() replacement, so needs to match the
510	# signature of __builtin__.apply.
511	def builtin_guarded_apply(func, args=(), kws={}):	6✔
512	# Check the args elements. args may be an arbitrary iterable, and
513	# iterating over it may consume it, so we also need to save away
514	# the arguments in a new list to pass on to the real apply().
515	i, arglist = 0, []	6✔
516	for elt in args:	6✔
517	guard(args, elt, i)	6✔
518	arglist.append(elt)	6✔
519	i += 1	6✔
520	# Check kws similarly. Checking the keys may not be strictly necessary,
521	# but better safe than sorry. A new argument dict is created just in
522	# case kws is a hostile user-defined instance that may do horrid things
523	# as a side-effect of calling items().
524	argdict = {}	6✔
525	for k, v in kws.items():	6✔
526	guard(kws, k)	6✔
527	guard(kws, v, k)	6✔
528	argdict[k] = v	6✔
529	return func(arglist, *argdict)	6✔
530
531
532	safe_builtins['apply'] = builtin_guarded_apply	6✔
533
534
535	def guarded_any(seq):	6✔
536	return any(guarded_iter(seq))	6✔
537
538
539	safe_builtins['any'] = guarded_any	6✔
540
541
542	def guarded_all(seq):	6✔
543	return all(guarded_iter(seq))	6✔
544
545
546	safe_builtins['all'] = guarded_all	6✔
547
548
549	# This metaclass supplies the security declarations that allow all
550	# attributes of a class and its instances to be read and written.
551	def _metaclass(name, bases, dict):	6✔
552	for k, v in dict.items():	6✔
553	if k.endswith('__roles__') and k[:len('__roles__')] not in dict:	6!
UNCOV 554	raise Unauthorized("Can't override security: %s" % k)	×
555	ob = type(name, bases, dict)	6✔
556	ob.__allow_access_to_unprotected_subobjects__ = 1	6✔
557	ob._guarded_writes = 1	6✔
558	return ob	6✔
559
560
561	valid_inplace_types = (list, set)	6✔
562
563
564	inplace_slots = {	6✔
565	'+=': '__iadd__',
566	'-=': '__isub__',
567	'*=': '__imul__',
568	'/=': (1 / 2 == 0) and '__idiv__' or '__itruediv__',
569	'//=': '__ifloordiv__',
570	'%=': '__imod__',
571	'**=': '__ipow__',
572	'<<=': '__ilshift__',
573	'>>=': '__irshift__',
574	'&=': '__iand__',
575	'^=': '__ixor__',
576	'\|=': '__ior__',
577	}
578
579
580	def __iadd__(x, y):	6✔
581	x += y	6✔
582	return x	6✔
583
584
585	def __isub__(x, y):	6✔
586	x -= y	6✔
587	return x	6✔
588
589
590	def __imul__(x, y):	6✔
591	x *= y	6✔
592	return x	6✔
593
594
595	def __idiv__(x, y):	6✔
596	x /= y	6✔
597	return x	6✔
598
599
600	def __ifloordiv__(x, y):	6✔
601	x //= y	6✔
602	return x	6✔
603
604
605	def __imod__(x, y):	6✔
606	x %= y	6✔
607	return x	6✔
608
609
610	def __ipow__(x, y):	6✔
611	x **= y	6✔
612	return x	6✔
613
614
615	def __ilshift__(x, y):	6✔
616	x <<= y	6✔
617	return x	6✔
618
619
620	def __irshift__(x, y):	6✔
621	x >>= y	6✔
622	return x	6✔
623
624
625	def __iand__(x, y):	6✔
626	x &= y	6✔
627	return x	6✔
628
629
630	def __ixor__(x, y):	6✔
631	x ^= y	6✔
632	return x	6✔
633
634
635	def __ior__(x, y):	6✔
636	x \|= y	6✔
637	return x	6✔
638
639
640	inplace_ops = {	6✔
641	'+=': __iadd__,
642	'-=': __isub__,
643	'*=': __imul__,
644	'/=': __idiv__,
645	'//=': __ifloordiv__,
646	'%=': __imod__,
647	'**=': __ipow__,
648	'<<=': __ilshift__,
649	'>>=': __irshift__,
650	'&=': __iand__,
651	'^=': __ixor__,
652	'\|=': __ior__,
653	}
654
655
656	def protected_inplacevar(op, var, expr):	6✔
657	"""Do an inplace operation
658
659	If the var has an inplace slot, then disallow the operation
660	unless the var an instance of ``valid_inplace_types``.
661	"""
662	if hasattr(var, inplace_slots[op]) and \	6✔
663	not isinstance(var, valid_inplace_types):
664	try:	6✔
665	cls = var.__class__	6✔
UNCOV 666	except AttributeError:	×
UNCOV 667	cls = type(var)	×
668	raise TypeError(	6✔
669	"Augmented assignment to %s objects is not allowed"
670	" in untrusted code" % cls.__name__)
671	return inplace_ops[op](var, expr)	6✔
672
673
674	# AccessControl clients generally need to set up a safe globals dict for
675	# use by restricted code. The get_safe_globals() function returns such
676	# a dict, containing '__builtins__' mapped to our safe bulitins, and
677	# bindings for all the special functions inserted into Python code by
678	# RestrictionMutator transformations. A client may wish to add more
679	# bindings to this dict. It's generally safe to do so, as
680	# get_safe_globals returns a (shallow) copy of a canonical safe globals
681	# dict.
682	# Exception: For obscure technical reasons, clients have to import
683	# guarded_getattr from this module (ZopeGuards) and plug it into the
684	# dict themselves, with key '_getattr_'.
685	_safe_globals = {	6✔
686	'__builtins__': safe_builtins,
687	'__metaclass__': _metaclass,
688	'_apply_': guarded_apply,
689	'_getitem_': guarded_getitem,
690	'_getiter_': guarded_iter,
691	'_iter_unpack_sequence_': guarded_iter_unpack_sequence,
692	'_unpack_sequence_': guarded_unpack_sequence,
693	'_print_': RestrictedPython.PrintCollector,
694	'_write_': full_write_guard,
695	'_inplacevar_': protected_inplacevar,
696	# The correct implementation of _getattr_, aka
697	# guarded_getattr, isn't known until
698	# AccessControl.Implementation figures that out, then
699	# stuffs it into this module's globals bound to
700	# 'guarded_getattr'. We can't know what that is at
701	# '_getattr_': guarded_getattr,
702	}
703
704	get_safe_globals = _safe_globals.copy	6✔
705
706	RestrictionCapableEval.globals.update(_safe_globals)	6✔

zopefoundation / AccessControl / 8234168124

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous