RestrictedPython 5.3__py2.py3-none-any.whl → 5.4__py2.py3-none-any.whl

RestrictedPython/Guards.py

@@ -264,9 +264,12 @@ def safer_getattr(object, name, default=None, getattr=getattr):
     http://lucumr.pocoo.org/2016/12/29/careful-with-str-format/
 
     """
-    if isinstance(object, _compat.basestring) and name == 'format':
+    if name in ('format', 'format_map') and (
+            isinstance(object, _compat.basestring) or (
+            isinstance(object, type)
+            and issubclass(object, _compat.basestring))):
         raise NotImplementedError(
-            'Using format() on a %s is not safe.' % object.__class__.__name__)
+            'Using the string format* methods is not safe')
     if name.startswith('_'):
         raise AttributeError(
             '"{name}" is an invalid attribute name because it '

RestrictedPython/Utilities.py

@@ -18,7 +18,21 @@ import string
 
 utility_builtins = {}
 
-utility_builtins['string'] = string
+
+class _AttributeDelegator:
+    def __init__(self, mod, *excludes):
+        """delegate attribute lookups outside *excludes* to module *mod*."""
+        self.__mod = mod
+        self.__excludes = excludes
+
+    def __getattr__(self, attr):
+        if attr in self.__excludes:
+            raise NotImplementedError(
+                "{}.{} is not safe".format(self.__mod.__name__, attr))
+        return getattr(self.__mod, attr)
+
+
+utility_builtins['string'] = _AttributeDelegator(string, "Formatter")
 utility_builtins['math'] = math
 utility_builtins['random'] = random
 utility_builtins['whrandom'] = random

{RestrictedPython-5.3.dist-info → RestrictedPython-5.4.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: RestrictedPython
-Version: 5.3
+Version: 5.4
 Summary: RestrictedPython is a defined subset of the Python language which allows to provide a program input into a trusted environment.
 Home-page: https://github.com/zopefoundation/RestrictedPython
 Author: Zope Foundation and Contributors
@@ -119,10 +119,23 @@ This example directly executed in Python could harm your system.
 Changes
 =======
 
+5.4 (2023-08-30)
+----------------
+
+Fixes
++++++
+
+- Fix information disclosure problems through
+  Python's "format" functionality
+  (``format`` and ``format_map`` methods on ``str``/``unicode`` and
+  their instances,
+  ``string.Formatter``).
+
+
 5.3 (2023-07-08)
 ----------------
 
-- Restrict access to some attributes accessible via the ``inspect`` module.
+- Forbid using some attributes providing access to restricted Python internals.
 
 
 5.2 (2021-11-19)

{RestrictedPython-5.3.dist-info → RestrictedPython-5.4.dist-info}/RECORD

@@ -1,14 +1,14 @@
 RestrictedPython/Eval.py,sha256=Aoe0YPXAmaY2DcTAycV76mXMtY7AyrvrHZk5pW6t4-4,3345
-RestrictedPython/Guards.py,sha256=qFF0tgfZBkx3wFxAEljnorItuuUzXR1ue40fbimqP8k,8033
+RestrictedPython/Guards.py,sha256=TXAXFqwA5M1IPE_eTViyNMOJuDMWF2HPfbB6SWYjwKQ,8143
 RestrictedPython/Limits.py,sha256=dORpuly21vSjy8gzNac9IYfIXMMWRVFvqUiKKIeZ3OM,1866
 RestrictedPython/PrintCollector.py,sha256=jFXjgp8WLj4mEkojEBn5EH0CbpVxVL7qkPq-9czTsgg,1183
-RestrictedPython/Utilities.py,sha256=55M4T7k59Zugkf0Tt_kOddITLajxEobD9Hq0kJEmSMQ,2505
+RestrictedPython/Utilities.py,sha256=NpWDdA0H5GrxB8Ljtx4zv_0Xj89gJjXeB_kW6pisijc,2967
 RestrictedPython/__init__.py,sha256=qB_s6zDxuXPAGMoKYKBMc-xZ0gTnQ0ZvtY5FxdAG3aM,1862
 RestrictedPython/_compat.py,sha256=0yS5CXqTswBoH0iNYFGYzpWv-VFLYiZPPaOJS70Ji6Q,713
 RestrictedPython/compile.py,sha256=vQkXBUDTC4Ng_gX5lGK9AVp61yvy8VdKv9xEamdtv9I,6920
 RestrictedPython/transformer.py,sha256=T9tzDZW8NrkCvG78HzlB9KRbgQztAckAFeCmDoc27Yk,50038
-RestrictedPython-5.3.dist-info/LICENSE.txt,sha256=PmcdsR32h1FswdtbPWXkqjg-rKPCDOo_r1Og9zNdCjw,2070
-RestrictedPython-5.3.dist-info/METADATA,sha256=bvwHsbFnfBjPFAbVbwZcaHY103aVra16mIbcrFl0PHo,11263
-RestrictedPython-5.3.dist-info/WHEEL,sha256=a-zpFRIJzOq5QfuhBzbhiA1eHTzNCJn8OdRvhdNX0Rk,110
-RestrictedPython-5.3.dist-info/top_level.txt,sha256=E1-3ARWcduVJnQAScms0FgqnBx_PovrzYsNMYuLGwa0,17
-RestrictedPython-5.3.dist-info/RECORD,,
+RestrictedPython-5.4.dist-info/LICENSE.txt,sha256=PmcdsR32h1FswdtbPWXkqjg-rKPCDOo_r1Og9zNdCjw,2070
+RestrictedPython-5.4.dist-info/METADATA,sha256=0hQNUC2lZ3PEr2MIGNeQ9M8c_ZTgbsBpkuIQ4jrSO30,11509
+RestrictedPython-5.4.dist-info/WHEEL,sha256=m9WAupmBd2JGDsXWQGJgMGXIWbQY3F5c2xBJbBhq0nY,110
+RestrictedPython-5.4.dist-info/top_level.txt,sha256=E1-3ARWcduVJnQAScms0FgqnBx_PovrzYsNMYuLGwa0,17
+RestrictedPython-5.4.dist-info/RECORD,,

{RestrictedPython-5.3.dist-info → RestrictedPython-5.4.dist-info}/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: bdist_wheel (0.40.0)
+Generator: bdist_wheel (0.41.1)
 Root-Is-Purelib: true
 Tag: py2-none-any
 Tag: py3-none-any