| Index: third_party/jinja2/sandbox.py
|
| diff --git a/third_party/jinja2/sandbox.py b/third_party/jinja2/sandbox.py
|
| index da479c1ba27847f5d33653825ef531d46c7b041b..7e40ab30850707104a139d1fa95c5c177a482aa5 100644
|
| --- a/third_party/jinja2/sandbox.py
|
| +++ b/third_party/jinja2/sandbox.py
|
| @@ -12,19 +12,25 @@
|
| :copyright: (c) 2010 by the Jinja Team.
|
| :license: BSD.
|
| """
|
| +import types
|
| import operator
|
| from jinja2.environment import Environment
|
| from jinja2.exceptions import SecurityError
|
| -from jinja2._compat import string_types, function_type, method_type, \
|
| - traceback_type, code_type, frame_type, generator_type, PY2
|
| +from jinja2._compat import string_types, PY2
|
|
|
|
|
| #: maximum number of items a range may produce
|
| MAX_RANGE = 100000
|
|
|
| #: attributes of function objects that are considered unsafe.
|
| -UNSAFE_FUNCTION_ATTRIBUTES = set(['func_closure', 'func_code', 'func_dict',
|
| - 'func_defaults', 'func_globals'])
|
| +if PY2:
|
| + UNSAFE_FUNCTION_ATTRIBUTES = set(['func_closure', 'func_code', 'func_dict',
|
| + 'func_defaults', 'func_globals'])
|
| +else:
|
| + # On versions > python 2 the special attributes on functions are gone,
|
| + # but they remain on methods and generators for whatever reason.
|
| + UNSAFE_FUNCTION_ATTRIBUTES = set()
|
| +
|
|
|
| #: unsafe method attributes. function attributes are unsafe for methods too
|
| UNSAFE_METHOD_ATTRIBUTES = set(['im_class', 'im_func', 'im_self'])
|
| @@ -32,11 +38,6 @@ UNSAFE_METHOD_ATTRIBUTES = set(['im_class', 'im_func', 'im_self'])
|
| #: unsafe generator attirbutes.
|
| UNSAFE_GENERATOR_ATTRIBUTES = set(['gi_frame', 'gi_code'])
|
|
|
| -# On versions > python 2 the special attributes on functions are gone,
|
| -# but they remain on methods and generators for whatever reason.
|
| -if not PY2:
|
| - UNSAFE_FUNCTION_ATTRIBUTES = set()
|
| -
|
| import warnings
|
|
|
| # make sure we don't warn in python 2.6 about stuff we don't care about
|
| @@ -124,26 +125,24 @@ def is_internal_attribute(obj, attr):
|
| :meth:`~SandboxedEnvironment.is_safe_attribute` is overridden.
|
|
|
| >>> from jinja2.sandbox import is_internal_attribute
|
| - >>> is_internal_attribute(lambda: None, "func_code")
|
| - True
|
| - >>> is_internal_attribute((lambda x:x).func_code, 'co_code')
|
| + >>> is_internal_attribute(str, "mro")
|
| True
|
| >>> is_internal_attribute(str, "upper")
|
| False
|
| """
|
| - if isinstance(obj, function_type):
|
| + if isinstance(obj, types.FunctionType):
|
| if attr in UNSAFE_FUNCTION_ATTRIBUTES:
|
| return True
|
| - elif isinstance(obj, method_type):
|
| + elif isinstance(obj, types.MethodType):
|
| if attr in UNSAFE_FUNCTION_ATTRIBUTES or \
|
| attr in UNSAFE_METHOD_ATTRIBUTES:
|
| return True
|
| elif isinstance(obj, type):
|
| if attr == 'mro':
|
| return True
|
| - elif isinstance(obj, (code_type, traceback_type, frame_type)):
|
| + elif isinstance(obj, (types.CodeType, types.TracebackType, types.FrameType)):
|
| return True
|
| - elif isinstance(obj, generator_type):
|
| + elif isinstance(obj, types.GeneratorType):
|
| if attr in UNSAFE_GENERATOR_ATTRIBUTES:
|
| return True
|
| return attr.startswith('__')
|
|
|