From f89eed42a00a8ab358050474c9a2315a40c57ee7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=BCrgen=20Gmach?= <juergen.gmach@googlemail.com>
Date: Sun, 7 Jul 2019 13:46:39 +0200
Subject: [PATCH] Show proper error message for not allowed identifiers. (#34)

Due to interaction between Script(Python) and RestrictedPython,
following identifiers are not allowed:
- context
- container
- script
- traverse_subpath

Instead of throwing an "IndexError", now a proper error messsage
is shown.

This closes #33

modified: src/Products/PythonScripts/PythonScript.py
modified: src/Products/PythonScripts/tests/testPythonScript.py
modified:   CHANGES.rst
---
 CHANGES.rst                                         |  2 ++
 src/Products/PythonScripts/PythonScript.py          | 10 +++++++++-
 .../PythonScripts/tests/testPythonScript.py         | 13 +++++++++++++
 3 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/CHANGES.rst b/CHANGES.rst
index 9605fa7..e799856 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -3,6 +3,8 @@ Changelog
 
 4.8 (unreleased)
 ----------------
+- Show proper error message for not allowed identifiers.
+  (`#33 <https://github.com/zopefoundation/Products.PythonScripts/issues/33>`_)
 
 
 4.7 (2019-05-21)
diff --git a/src/Products/PythonScripts/PythonScript.py b/src/Products/PythonScripts/PythonScript.py
index ab98ce7..103cb7c 100644
--- a/src/Products/PythonScripts/PythonScript.py
+++ b/src/Products/PythonScripts/PythonScript.py
@@ -123,8 +123,16 @@ class PythonScript(Script, Cacheable):
         Cacheable.manage_options
 
     def __init__(self, id):
-        self.id = id
         self.ZBindings_edit(defaultBindings)
+        bind_names = self.getBindingAssignments().getAssignedNamesInOrder()
+        if id in bind_names:
+            raise ValueError(
+                'Following names are not allowed as identifiers, as they'
+                'have a special meaning for PythonScript: '
+                '%s.'
+                'Please choose another name.' % ', '.join(bind_names),
+                )
+        self.id = id
         self._makeFunction()
 
     security = ClassSecurityInfo()
diff --git a/src/Products/PythonScripts/tests/testPythonScript.py b/src/Products/PythonScripts/tests/testPythonScript.py
index 3180da3..13ed63c 100644
--- a/src/Products/PythonScripts/tests/testPythonScript.py
+++ b/src/Products/PythonScripts/tests/testPythonScript.py
@@ -272,6 +272,19 @@ def testAttributeAssignment(self):
                 func = self._newPS(defn + '\n' + asn % name)
                 self.assertRaises(TypeError, func)
 
+    def testBadIdentifiers(self):
+        """Some identifiers have to be avoided.
+
+        Background:
+        https://github.com/zopefoundation/Zope/issues/669
+        """
+        bad_identifiers = [
+            'context', 'container', 'script', 'traverse_subpath',
+            ]
+        for identifier in bad_identifiers:
+            with self.assertRaises(ValueError):
+                PythonScript(identifier)
+
 
 class TestPythonScriptGlobals(PythonScriptTestBase):