Add a strict mode for gclient DEPS parsing, to enable saner parsing constraints.

gclient.py

 #!/usr/bin/env python
 # Copyright (c) 2012 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 """Meta checkout manager supporting both Subversion and GIT."""
 # Files
 #   .gclient      : Current client configuration, written by 'config' command.
 #                   Format is a Python script defining 'solutions', a list whose
 #                   entries each are maps binding the strings "name" and "url"
@@ skipping 496 matching lines @@
         target_os_deps[os_dep_key] = sorted(possible_values)[0]
 
     new_deps = deps.copy()
     new_deps.update(target_os_deps)
     return new_deps
 
   def ParseDepsFile(self):
     """Parses the DEPS file for this dependency."""
     assert not self.deps_parsed
     assert not self.dependencies
-    # One thing is unintuitive, vars = {} must happen before Var() use.
-    local_scope = {}
-    var = self.VarImpl(self.custom_vars, local_scope)
-    global_scope = {
-      'File': self.FileImpl,
-      'From': self.FromImpl,
-      'Var': var.Lookup,
-      'deps_os': {},
-    }
+
+    deps_content = None
+    use_strict = False
     filepath = os.path.join(self.root.root_dir, self.name, self.deps_file)
     if not os.path.isfile(filepath):
       logging.info(
           'ParseDepsFile(%s): No %s file found at %s' % (
             self.name, self.deps_file, filepath))
     else:
       deps_content = gclient_utils.FileRead(filepath)
       logging.debug('ParseDepsFile(%s) read:\n%s' % (self.name, deps_content))
+      use_strict = 'use strict' in deps_content.splitlines()[0]
+
+    local_scope = {}
+    if deps_content:
+      # One thing is unintuitive, vars = {} must happen before Var() use.
+      var = self.VarImpl(self.custom_vars, local_scope)
+      if use_strict:
+        logging.info(
+          'ParseDepsFile(%s): Strict Mode Enabled', self.name)
+        global_scope = {
+          '__builtins__': {'None': None},
+          'Var': var.Lookup,
+          'deps_os': {},
+        }
+      else:
+        global_scope = {
+          'File': self.FileImpl,
+          'From': self.FromImpl,
+          'Var': var.Lookup,
+          'deps_os': {},
+        }
       # Eval the content.
       try:
         exec(deps_content, global_scope, local_scope)
       except SyntaxError, e:
         gclient_utils.SyntaxErrorToError(filepath, e)
+      if use_strict:
+        for key, val in local_scope.iteritems():
+          if not isinstance(val, (dict, list, tuple, str)):
+            raise gclient_utils.Error(
+              'ParseDepsFile(%s): Strict mode disallows %r -> %r' %
+              (self.name, key, val))
+
     deps = local_scope.get('deps', {})
     if 'recursion' in local_scope:
       self.recursion_override = local_scope.get('recursion')
       logging.warning(
           'Setting %s recursion to %d.', self.name, self.recursion_limit)
     # If present, save 'target_os' in the local_target_os property.
     if 'target_os' in local_scope:
       self.local_target_os = local_scope['target_os']
     # load os specific dependencies if defined.  these dependencies may
     # override or extend the values defined by the 'deps' member.
@@ skipping 1434 matching lines @@
     print >> sys.stderr, 'Error: %s' % str(e)
     return 1
   finally:
     gclient_utils.PrintWarnings()
 
 
 if '__main__' == __name__:
   sys.exit(Main(sys.argv[1:]))
 
 # vim: ts=2:sw=2:tw=80:et: