diff --git a/SpreadSheetPlugin/lib/Foswiki/Plugins/SpreadSheetPlugin/Calc.pm b/SpreadSheetPlugin/lib/Foswiki/Plugins/SpreadSheetPlugin/Calc.pm index 0fd11f1b2..d86256838 100644 --- a/SpreadSheetPlugin/lib/Foswiki/Plugins/SpreadSheetPlugin/Calc.pm +++ b/SpreadSheetPlugin/lib/Foswiki/Plugins/SpreadSheetPlugin/Calc.pm @@ -1730,19 +1730,21 @@ sub _safeEvalPerl { # keep only numbers and operators $theText =~ s/[^\!\<\=\>\-\+\*\/\%0-9e\.\(\)]*//g; - # disable glob for security reasons - $theText =~ s/^([\(\s]*)\<+/$1/g; - $theText =~ s/\>+([\s\)]*)$/$1/g; - $theText =~ s/\<\s*\>/ /g; - # remove leading 0s to defuse interpretation of numbers as octals $theText =~ s/(^|[^\.])\b0+(?=[0-9])/$1/g; # remove "e"-s unless in expression such as "123e-4" $theText =~ s/(^|[^0-9])e/$1/g; $theText =~ /(.*)/; - $theText = $1; # untainted variable + $theText = $1; # untainted variable + + # disable glob for security reasons + $theText =~ s/^([\(\s]*)\<+/$1/g; + $theText =~ s/\>+([\s\)]*)$/$1/g; + $theText =~ s/\<\s*\>/ /g; + return "" unless defined($theText); + local $SIG{__DIE__} = sub { Foswiki::Func::writeDebug( $_[0] ); warn $_[0] }; my $result = eval $theText;