Skip to content

Commit

Permalink
Move _kwargsEval to ufo2ft.util
Browse files Browse the repository at this point in the history
  • Loading branch information
moyogo committed Feb 25, 2021
1 parent a6c2636 commit 8a06d80
Show file tree
Hide file tree
Showing 3 changed files with 15 additions and 13 deletions.
14 changes: 2 additions & 12 deletions Lib/ufo2ft/featureWriters/__init__.py
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@
import re
from inspect import isclass

from ufo2ft.util import _kwargsEval

from .baseFeatureWriter import BaseFeatureWriter
from .kernFeatureWriter import KernFeatureWriter
from .markFeatureWriter import MarkFeatureWriter
Expand Down Expand Up @@ -95,18 +97,6 @@ def loadFeatureWriters(ufo, ignoreErrors=True):
return writers


# NOTE about the security risk involved in using eval: the function below is
# meant to be used to parse string coming from the command-line, which is
# inherently "trusted"; if that weren't the case, a potential attacker
# could do worse things than segfaulting the Python interpreter...


def _kwargsEval(s):
return eval(
"dict(%s)" % s, {"__builtins__": {"True": True, "False": False, "dict": dict}}
)


_featureWriterSpecRE = re.compile(
r"(?:([\w\.]+)::)?" # MODULE_NAME + '::'
r"(\w+)" # CLASS_NAME [required]
Expand Down
2 changes: 1 addition & 1 deletion Lib/ufo2ft/filters/__init__.py
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
from inspect import getfullargspec, isclass

from ufo2ft.constants import FILTERS_KEY as UFO2FT_FILTERS_KEY # keep previous name
from ufo2ft.featureWriters import _kwargsEval
from ufo2ft.util import _kwargsEval

from .base import BaseFilter
from .cubicToQuadratic import CubicToQuadraticFilter
Expand Down
12 changes: 12 additions & 0 deletions Lib/ufo2ft/util.py
Original file line number Diff line number Diff line change
Expand Up @@ -419,3 +419,15 @@ def _getDefaultNotdefGlyph(designSpaceDoc):
except KeyError:
notdefGlyph = None
return notdefGlyph


# NOTE about the security risk involved in using eval: the function below is
# meant to be used to parse string coming from the command-line, which is
# inherently "trusted"; if that weren't the case, a potential attacker
# could do worse things than segfaulting the Python interpreter...


def _kwargsEval(s):
return eval(
"dict(%s)" % s, {"__builtins__": {"True": True, "False": False, "dict": dict}}
)

0 comments on commit 8a06d80

Please sign in to comment.