Item15192: updated fix to $EVAL()

foswiki · May 22, 2023 · e3afa2c · e3afa2c
1 parent 6759b46
commit e3afa2c
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/SpreadSheetPlugin/lib/Foswiki/Plugins/SpreadSheetPlugin/Calc.pm b/SpreadSheetPlugin/lib/Foswiki/Plugins/SpreadSheetPlugin/Calc.pm
@@ -1741,7 +1741,7 @@ sub _safeEvalPerl {
     # disable glob for security reasons
     $theText =~ s/^([\(\s]*)\<+/$1/g;
     $theText =~ s/\>+([\s\)]*)$/$1/g;
-    $theText =~ s/\<\s*\>/ /g;
+    $theText =~ s/\<[\.\*\/\?\s]*\>/ /g;
 
     return "" unless defined($theText);
 

diff --git a/SpreadSheetPlugin/test/unit/SpreadSheetPlugin/SpreadSheetPluginTests.pm b/SpreadSheetPlugin/test/unit/SpreadSheetPlugin/SpreadSheetPluginTests.pm
@@ -444,6 +444,12 @@ sub test_EVAL_GLOB {
     $this->assert( $this->CALC('$EVAL(<>)') == 0 );
     $this->assert( $this->CALC('$EVAL(2+<>+2)') == 4 );
     $this->assert( $this->CALC('$EVAL(2+<   >+2)') == 4 );
+    $this->assert( $this->CALC('$EVAL(%+.<*>.2)') =~ /^ERROR:/ );
+    $this->assert( $this->CALC('$EVAL(2+<e>+2)') == 4 );
+    $this->assert( $this->CALC('$EVAL(2+<x>+2)') == 4 );
+    $this->assert( $this->CALC('$EVAL(%-.<*>.2)')    =~ /^ERROR:/ );
+    $this->assert( $this->CALC('$EVAL(%+.<../*>.2)') =~ /^ERROR:/ );
+    $this->assert( $this->CALC('$EVAL(3-<../*>-3)') == 6 );
 }
 
 sub test_EVEN {