Skip to content

Commit

Permalink
Merge pull request #29 from daveisfera/master
Browse files Browse the repository at this point in the history
Clean up lint errors and increase test coverage
  • Loading branch information
danthedeckie committed Feb 22, 2017
2 parents 265ce49 + 15b0e40 commit f7c75a3
Show file tree
Hide file tree
Showing 3 changed files with 11 additions and 10 deletions.
5 changes: 3 additions & 2 deletions setup.py
Original file line number Diff line number Diff line change
@@ -1,12 +1,13 @@
from setuptools import setup

__version__ = '0.9.5'

setup(
name='simpleeval',
py_modules=['simpleeval'],
version=__version__,
description='A simple, safe single expression evaluator library.',
long_description=open('README.rst','r').read(),
long_description=open('README.rst', 'r').read(),
author='Daniel Fairhead',
author_email='danthedeckie@gmail.com',
url='https://github.com/danthedeckie/simpleeval',
Expand All @@ -20,4 +21,4 @@
'Topic :: Software Development :: Libraries :: Python Modules',
'Programming Language :: Python',
],
)
)
6 changes: 3 additions & 3 deletions simpleeval.py
Original file line number Diff line number Diff line change
Expand Up @@ -263,6 +263,8 @@ def __init__(self, operators=None, functions=None, names=None):
# py3k stuff:
if hasattr(ast, 'NameConstant'):
self.nodes[ast.NameConstant] = self._eval_nameconstant
elif isinstance(self.names, dict) and "None" not in self.names:
self.names["None"] = None

def eval(self, expr):
""" evaluate an expresssion, using the operators, functions and
Expand Down Expand Up @@ -362,9 +364,7 @@ def _eval_name(self, node):
# that there is a true exression assigning to none
# (the compiler rejects it, so you can't even
# pass that to ast.parse)
if node.id == "None":
return None
elif isinstance(self.names, dict):
if isinstance(self.names, dict):
return self.names[node.id]
elif callable(self.names):
return self.names(node)
Expand Down
10 changes: 5 additions & 5 deletions test_simpleeval.py
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,7 @@ def test_maths_with_ints(self):
def test_bools_and_or(self):
self.t('True and False', False)
self.t('True or False', True)
self.t('False or False', False)
self.t('1 - 1 or 21', 21)
self.t('1 - 1 and 11', 0)
self.t('110 == 100 + 10 and True', True)
Expand Down Expand Up @@ -379,6 +380,7 @@ def _quasi_private():
dis = simpleeval.DISALLOW_PREFIXES
simpleeval.DISALLOW_PREFIXES = ['func_']

self.t('houdini.trapdoor()', 42)
self.t('houdini._quasi_private()', 84)

# and return things to normal
Expand All @@ -388,7 +390,8 @@ def _quasi_private():
def test_builtins_private_access(self):
# explicit attempt of the exploit from perkinslr
with self.assertRaises(simpleeval.FeatureNotAvailable):
self.t("True.__class__.__class__.__base__.__subclasses__()[-1].__init__.func_globals['sys'].exit(1)", 42)
self.t("True.__class__.__class__.__base__.__subclasses__()[-1]"
".__init__.func_globals['sys'].exit(1)", 42)


class TestCompoundTypes(DRYTest):
Expand Down Expand Up @@ -672,10 +675,7 @@ def _eval_call(self, node):

self.assertEqual(e.eval('"stuff happens"'), "stuff happens")
self.assertEqual(e.eval('22 + 20'), 42)
self.assertEqual(e.eval('int("42")'), 42)

with self.assertRaises(simpleeval.FeatureNotAvailable):
e.eval('" blah ".strip()')


if __name__ == '__main__':
unittest.main()

0 comments on commit f7c75a3

Please sign in to comment.