Skip to content

Commit

Permalink
Restrict builtins within lambdas for ImageMath.eval
Browse files Browse the repository at this point in the history
  • Loading branch information
radarhere committed Feb 2, 2022
1 parent 75b69dd commit c930be0
Show file tree
Hide file tree
Showing 2 changed files with 21 additions and 6 deletions.
12 changes: 10 additions & 2 deletions Tests/test_imagemath.py
Original file line number Diff line number Diff line change
Expand Up @@ -52,9 +52,17 @@ def test_ops():
assert pixel(ImageMath.eval("float(B)**33", images)) == "F 8589934592.0"


def test_prevent_exec():
@pytest.mark.parametrize(
"expression",
(
"exec('pass')",
"(lambda: exec('pass'))()",
"(lambda: (lambda: exec('pass'))())()",
),
)
def test_prevent_exec(expression):
with pytest.raises(ValueError):
ImageMath.eval("exec('pass')")
ImageMath.eval(expression)


def test_logical():
Expand Down
15 changes: 11 additions & 4 deletions src/PIL/ImageMath.py
Original file line number Diff line number Diff line change
Expand Up @@ -246,11 +246,18 @@ def eval(expression, _dict={}, **kw):
if hasattr(v, "im"):
args[k] = _Operand(v)

code = compile(expression, "<string>", "eval")
for name in code.co_names:
if name not in args and name != "abs":
raise ValueError(f"'{name}' not allowed")
compiled_code = compile(expression, "<string>", "eval")

def scan(code):
for const in code.co_consts:
if type(const) == type(compiled_code):
scan(const)

for name in code.co_names:
if name not in args and name != "abs":
raise ValueError(f"'{name}' not allowed")

scan(compiled_code)
out = builtins.eval(expression, {"__builtins": {"abs": abs}}, args)
try:
return out.im
Expand Down

0 comments on commit c930be0

Please sign in to comment.