From 5cdd3f45d0b38df52d8a68d5d6708e95c9bdcdd2 Mon Sep 17 00:00:00 2001
From: Alexander Loechel <loechel@users.noreply.github.com>
Date: Thu, 17 May 2018 09:30:03 +0200
Subject: [PATCH] deny * imports (#106)

* deny * imports
---
 docs/CHANGES.rst                    |  5 ++++-
 src/RestrictedPython/transformer.py | 10 ++++++----
 tests/transformer/test_import.py    | 16 ++++++++++++++++
 3 files changed, 26 insertions(+), 5 deletions(-)

diff --git a/docs/CHANGES.rst b/docs/CHANGES.rst
index 196c8ba..dc0e39e 100644
--- a/docs/CHANGES.rst
+++ b/docs/CHANGES.rst
@@ -4,7 +4,10 @@ Changes
 4.0b4 (unreleased)
 ------------------
 
-- Nothing changed yet.
+- Imports like `from a import *` (so called star imports) are now forbidden as
+  they allow to import names starting with an underscore which could override
+  protected build-ins.
+  (`#102 <https://github.com/zopefoundation/RestrictedPython/issues/102>`_)
 
 
 4.0b3 (2018-04-12)
diff --git a/src/RestrictedPython/transformer.py b/src/RestrictedPython/transformer.py
index abdeed3..4f0642a 100644
--- a/src/RestrictedPython/transformer.py
+++ b/src/RestrictedPython/transformer.py
@@ -427,10 +427,12 @@ def check_import_names(self, node):
 
         => 'from _a import x' is ok, because '_a' is not added to the scope.
         """
-        for alias in node.names:
-            self.check_name(node, alias.name)
-            if alias.asname:
-                self.check_name(node, alias.asname)
+        for name in node.names:
+            if '*' in name.name:
+                self.error(node, '"*" imports are not allowed.')
+            self.check_name(node, name.name)
+            if name.asname:
+                self.check_name(node, name.asname)
 
         return self.node_contents_visit(node)
 
diff --git a/tests/transformer/test_import.py b/tests/transformer/test_import.py
index 89679c7..868ae15 100644
--- a/tests/transformer/test_import.py
+++ b/tests/transformer/test_import.py
@@ -71,3 +71,19 @@ def test_RestrictingNodeTransformer__visit_Import__9(c_exec):
     """It denies relative from importing as something starting with `_`."""
     result = c_exec('from .x import y as _leading_underscore')
     assert result.errors == (import_errmsg % '_leading_underscore',)
+
+
+@pytest.mark.parametrize(*c_exec)
+def test_RestrictingNodeTransformer__visit_Import_star__1(c_exec):
+    """Importing `*` is a SyntaxError in Python itself."""
+    result = c_exec('import *')
+    assert result.errors == ('Line 1: SyntaxError: invalid syntax in on statement: import *',)  # NOQA: E501
+    assert result.code is None
+
+
+@pytest.mark.parametrize(*c_exec)
+def test_RestrictingNodeTransformer__visit_Import_star__2(c_exec):
+    """It denies importing `*` from a module."""
+    result = c_exec('from a import *')
+    assert result.errors == ('Line 1: "*" imports are not allowed.',)
+    assert result.code is None