Index: third_party/jinja2/sandbox.py |
diff --git a/third_party/jinja2/sandbox.py b/third_party/jinja2/sandbox.py |
index a1cbb29ac3166101945ea9f8e9fdb49c60095d31..da479c1ba27847f5d33653825ef531d46c7b041b 100644 |
--- a/third_party/jinja2/sandbox.py |
+++ b/third_party/jinja2/sandbox.py |
@@ -15,8 +15,8 @@ |
import operator |
from jinja2.environment import Environment |
from jinja2.exceptions import SecurityError |
-from jinja2.utils import FunctionType, MethodType, TracebackType, CodeType, \ |
- FrameType, GeneratorType |
+from jinja2._compat import string_types, function_type, method_type, \ |
+ traceback_type, code_type, frame_type, generator_type, PY2 |
#: maximum number of items a range may produce |
@@ -29,6 +29,13 @@ UNSAFE_FUNCTION_ATTRIBUTES = set(['func_closure', 'func_code', 'func_dict', |
#: unsafe method attributes. function attributes are unsafe for methods too |
UNSAFE_METHOD_ATTRIBUTES = set(['im_class', 'im_func', 'im_self']) |
+#: unsafe generator attirbutes. |
+UNSAFE_GENERATOR_ATTRIBUTES = set(['gi_frame', 'gi_code']) |
+ |
+# On versions > python 2 the special attributes on functions are gone, |
+# but they remain on methods and generators for whatever reason. |
+if not PY2: |
+ UNSAFE_FUNCTION_ATTRIBUTES = set() |
import warnings |
@@ -90,7 +97,7 @@ def safe_range(*args): |
"""A range that can't generate ranges with a length of more than |
MAX_RANGE items. |
""" |
- rng = xrange(*args) |
+ rng = range(*args) |
if len(rng) > MAX_RANGE: |
raise OverflowError('range too big, maximum size for range is %d' % |
MAX_RANGE) |
@@ -114,7 +121,7 @@ def is_internal_attribute(obj, attr): |
"""Test if the attribute given is an internal python attribute. For |
example this function returns `True` for the `func_code` attribute of |
python objects. This is useful if the environment method |
- :meth:`~SandboxedEnvironment.is_safe_attribute` is overriden. |
+ :meth:`~SandboxedEnvironment.is_safe_attribute` is overridden. |
>>> from jinja2.sandbox import is_internal_attribute |
>>> is_internal_attribute(lambda: None, "func_code") |
@@ -124,20 +131,20 @@ def is_internal_attribute(obj, attr): |
>>> is_internal_attribute(str, "upper") |
False |
""" |
- if isinstance(obj, FunctionType): |
+ if isinstance(obj, function_type): |
if attr in UNSAFE_FUNCTION_ATTRIBUTES: |
return True |
- elif isinstance(obj, MethodType): |
+ elif isinstance(obj, method_type): |
if attr in UNSAFE_FUNCTION_ATTRIBUTES or \ |
attr in UNSAFE_METHOD_ATTRIBUTES: |
return True |
elif isinstance(obj, type): |
if attr == 'mro': |
return True |
- elif isinstance(obj, (CodeType, TracebackType, FrameType)): |
+ elif isinstance(obj, (code_type, traceback_type, frame_type)): |
return True |
- elif isinstance(obj, GeneratorType): |
- if attr == 'gi_frame': |
+ elif isinstance(obj, generator_type): |
+ if attr in UNSAFE_GENERATOR_ATTRIBUTES: |
return True |
return attr.startswith('__') |
@@ -299,7 +306,7 @@ class SandboxedEnvironment(Environment): |
try: |
return obj[argument] |
except (TypeError, LookupError): |
- if isinstance(argument, basestring): |
+ if isinstance(argument, string_types): |
try: |
attr = str(argument) |
except Exception: |