RestrictedPython 7.2a1.dev0__py3-none-any.whl → 7.3__py3-none-any.whl

RestrictedPython/Guards.py

@@ -18,6 +18,7 @@
 import builtins
 
 from RestrictedPython._compat import IS_PY311_OR_GREATER
+from RestrictedPython.transformer import INSPECT_ATTRIBUTES
 
 
 safe_builtins = {}
@@ -246,11 +247,17 @@ def safer_getattr(object, name, default=None, getattr=getattr):
     http://lucumr.pocoo.org/2016/12/29/careful-with-str-format/
 
     """
+    if type(name) is not str:
+        raise TypeError('type(name) must be str')
     if name in ('format', 'format_map') and (
             isinstance(object, str) or
             (isinstance(object, type) and issubclass(object, str))):
         raise NotImplementedError(
             'Using the format*() methods of `str` is not safe')
+    if name in INSPECT_ATTRIBUTES:
+        raise AttributeError(
+            f'"{name}" is a restricted name,'
+            ' that is forbidden to access in RestrictedPython.')
     if name.startswith('_'):
         raise AttributeError(
             '"{name}" is an invalid attribute name because it '

RestrictedPython/Utilities.py

@@ -29,7 +29,11 @@ class _AttributeDelegator:
         if attr in self.__excludes:
             raise NotImplementedError(
                 f"{self.__mod.__name__}.{attr} is not safe")
-        return getattr(self.__mod, attr)
+        try:
+            return getattr(self.__mod, attr)
+        except AttributeError as e:
+            e.obj = self
+            raise
 
 
 utility_builtins['string'] = _AttributeDelegator(string, "Formatter")

RestrictedPython/transformer.py

@@ -593,6 +593,10 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
             """
             return self.node_contents_visit(node)
 
+    def visit_Interactive(self, node):
+        """Allow single mode without restrictions."""
+        return self.node_contents_visit(node)
+
     def visit_List(self, node):
         """Allow list literals without restrictions."""
         return self.node_contents_visit(node)

{RestrictedPython-7.2a1.dev0.dist-info → RestrictedPython-7.3.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: RestrictedPython
-Version: 7.2a1.dev0
+Version: 7.3
 Summary: RestrictedPython is a defined subset of the Python language which allows to provide a program input into a trusted environment.
 Home-page: https://github.com/zopefoundation/RestrictedPython
 Author: Zope Foundation and Contributors
@@ -23,7 +23,7 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Topic :: Security
-Requires-Python: >=3.7, <3.14
+Requires-Python: >=3.7, <3.13
 Description-Content-Type: text/x-rst
 License-File: LICENSE.txt
 Provides-Extra: docs
@@ -124,11 +124,25 @@ the documentation `Contributing page
 Changes
 =======
 
-7.2a1.dev0 (2024-03-14)
------------------------
+7.3 (2024-09-30)
+----------------
+
+- Increase the safety level of ``safer_getattr`` allowing applications to use
+  it as ``getattr`` implementation. Such use should now follow the same policy
+  and give the same level of protection as direct attribute access in an
+  environment based on ``RestrictedPython``'s ``safe_builtints``.
+- Prevent information leakage via ``AttributeError.obj``
+  and the ``string`` module.
+
+
+7.2 (2024-08-02)
+----------------
 
-- Allow to use the package with Python 3.13 -- Caution: No security
-  audit has been done so far.
+- Remove unneeded setuptools fossils that may cause installation problems
+  with recent setuptools versions.
+- Add support for single mode statements / execution.
+- Fix a potential breakout capability in the provided ``safer_getattr`` method
+  that is part of the ``safer_builtins``.
 
 
 7.1 (2024-03-14)

RestrictedPython-7.3.dist-info/RECORD

@@ -0,0 +1,14 @@
+RestrictedPython/Eval.py,sha256=pa79tc-JsT7xfzwg0ceMkxyioIEnFbNHc_PsKUhkkj8,3201
+RestrictedPython/Guards.py,sha256=YV-gxQZoXXzr7pLF3ovpVdVmKgsQ4LVcET6T-dHEMns,7962
+RestrictedPython/Limits.py,sha256=dORpuly21vSjy8gzNac9IYfIXMMWRVFvqUiKKIeZ3OM,1866
+RestrictedPython/PrintCollector.py,sha256=bBCpnUPOuKz1wJDuSgh7wo2aoKfcTJeeT8OYnM-K9F8,1137
+RestrictedPython/Utilities.py,sha256=u4HUdyjGawaeHyXSakyt4gRT17BZietXnF5WqicujjE,3033
+RestrictedPython/__init__.py,sha256=qB_s6zDxuXPAGMoKYKBMc-xZ0gTnQ0ZvtY5FxdAG3aM,1862
+RestrictedPython/_compat.py,sha256=nacdAJi4E8GKhkR99_BAxMA0AtK2FQnvrqZbG8hGofc,383
+RestrictedPython/compile.py,sha256=IhcF733t-bkPcvfQ2_NyBeCbSIPtHYxR-GQNNHnaMHM,6727
+RestrictedPython/transformer.py,sha256=toPGqFvc9WM1bnh2yIgNZcsz0ySwlSyJXViCSau-19I,42906
+RestrictedPython-7.3.dist-info/LICENSE.txt,sha256=PmcdsR32h1FswdtbPWXkqjg-rKPCDOo_r1Og9zNdCjw,2070
+RestrictedPython-7.3.dist-info/METADATA,sha256=J-IFLeEBGFCNsFn1FitgU1b_fA_dzSV1BfLiuicqLlI,12981
+RestrictedPython-7.3.dist-info/WHEEL,sha256=oiQVh_5PnQM0E3gPdiz09WCNmwiHDMaGer_elqB3coM,92
+RestrictedPython-7.3.dist-info/top_level.txt,sha256=E1-3ARWcduVJnQAScms0FgqnBx_PovrzYsNMYuLGwa0,17
+RestrictedPython-7.3.dist-info/RECORD,,

RestrictedPython-7.2a1.dev0.dist-info/RECORD

@@ -1,14 +0,0 @@
-RestrictedPython/Eval.py,sha256=pa79tc-JsT7xfzwg0ceMkxyioIEnFbNHc_PsKUhkkj8,3201
-RestrictedPython/Guards.py,sha256=XXupE0TwcWdb6qAsSexWUYEIeT3bVLTdOVvn94eoqs0,7646
-RestrictedPython/Limits.py,sha256=dORpuly21vSjy8gzNac9IYfIXMMWRVFvqUiKKIeZ3OM,1866
-RestrictedPython/PrintCollector.py,sha256=bBCpnUPOuKz1wJDuSgh7wo2aoKfcTJeeT8OYnM-K9F8,1137
-RestrictedPython/Utilities.py,sha256=7R6Op1Oqw9-fSxy_eWVa6ioZPx-SAxa7OolDObTWRkU,2937
-RestrictedPython/__init__.py,sha256=qB_s6zDxuXPAGMoKYKBMc-xZ0gTnQ0ZvtY5FxdAG3aM,1862
-RestrictedPython/_compat.py,sha256=nacdAJi4E8GKhkR99_BAxMA0AtK2FQnvrqZbG8hGofc,383
-RestrictedPython/compile.py,sha256=IhcF733t-bkPcvfQ2_NyBeCbSIPtHYxR-GQNNHnaMHM,6727
-RestrictedPython/transformer.py,sha256=AsPDuEN42OrBZBDtDCOFcWssNZrvm8PBGku8IvREXFg,42766
-RestrictedPython-7.2a1.dev0.dist-info/LICENSE.txt,sha256=PmcdsR32h1FswdtbPWXkqjg-rKPCDOo_r1Og9zNdCjw,2070
-RestrictedPython-7.2a1.dev0.dist-info/METADATA,sha256=V23yHfhhH7oSZr2ClO4fp6hkl0XVT5Xr1bveMPANdfw,12397
-RestrictedPython-7.2a1.dev0.dist-info/WHEEL,sha256=oiQVh_5PnQM0E3gPdiz09WCNmwiHDMaGer_elqB3coM,92
-RestrictedPython-7.2a1.dev0.dist-info/top_level.txt,sha256=E1-3ARWcduVJnQAScms0FgqnBx_PovrzYsNMYuLGwa0,17
-RestrictedPython-7.2a1.dev0.dist-info/RECORD,,