RestrictedPython 7.4__tar.gz → 8.0__tar.gz

{restrictedpython-7.4 → restrictedpython-8.0}/.pre-commit-config.yaml

@@ -12,10 +12,10 @@ repos:
     - id: autopep8
       args: [--in-place, --aggressive, --aggressive]
   - repo: https://github.com/asottile/pyupgrade
-    rev: v3.17.0
+    rev: v3.19.0
     hooks:
     - id: pyupgrade
-      args: [--py38-plus]
+      args: [--py39-plus]
   - repo: https://github.com/isidentical/teyit
     rev: 0.4.3
     hooks:

{restrictedpython-7.4 → restrictedpython-8.0}/CHANGES.rst

@@ -1,6 +1,27 @@
 Changes
 =======
 
+8.0 (2025-01-23)
+----------------
+
+Backwards incompatible changes
+++++++++++++++++++++++++++++++
+
+- Disallow ``try/except*`` clauses due to a possible sandbox escape and
+  probable uselessness of this feature in the context of ``RestrictedPython``.
+  In addition, remove ``ExceptionGroup`` from ``safe_builtins`` (as useful only
+  with ``try/except*``). - This feature was introduced into
+  ``RestrictedPython`` in version 6.0 for Python 3.11+. (CVE-2025-22153)
+
+- Drop support for Python 3.8.
+
+Features
+++++++++
+
+- Update setuptools version pin.
+  (`#292 <https://github.com/zopefoundation/RestrictedPython/issues/292>`_)
+
+
 7.4 (2024-10-09)
 ----------------
 

{restrictedpython-7.4 → restrictedpython-8.0}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.1
 Name: RestrictedPython
-Version: 7.4
+Version: 8.0
 Summary: RestrictedPython is a defined subset of the Python language which allows to provide a program input into a trusted environment.
 Home-page: https://github.com/zopefoundation/RestrictedPython
 Author: Zope Foundation and Contributors
 Author-email: zope-dev@zope.dev
-License: ZPL 2.1
+License: ZPL-2.1
 Project-URL: Documentation, https://restrictedpython.readthedocs.io/
 Project-URL: Source, https://github.com/zopefoundation/RestrictedPython
 Project-URL: Tracker, https://github.com/zopefoundation/RestrictedPython/issues
@@ -15,7 +15,6 @@ Classifier: License :: OSI Approved :: Zope Public License
 Classifier: Programming Language :: Python
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
@@ -23,7 +22,7 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Topic :: Security
-Requires-Python: >=3.8, <3.14
+Requires-Python: >=3.9, <3.14
 Description-Content-Type: text/x-rst
 License-File: LICENSE.txt
 Provides-Extra: test
@@ -124,6 +123,27 @@ the documentation `Contributing page
 Changes
 =======
 
+8.0 (2025-01-23)
+----------------
+
+Backwards incompatible changes
+++++++++++++++++++++++++++++++
+
+- Disallow ``try/except*`` clauses due to a possible sandbox escape and
+  probable uselessness of this feature in the context of ``RestrictedPython``.
+  In addition, remove ``ExceptionGroup`` from ``safe_builtins`` (as useful only
+  with ``try/except*``). - This feature was introduced into
+  ``RestrictedPython`` in version 6.0 for Python 3.11+. (CVE-2025-22153)
+
+- Drop support for Python 3.8.
+
+Features
+++++++++
+
+- Update setuptools version pin.
+  (`#292 <https://github.com/zopefoundation/RestrictedPython/issues/292>`_)
+
+
 7.4 (2024-10-09)
 ----------------
 

{restrictedpython-7.4 → restrictedpython-8.0}/docs/conf.py

@@ -60,9 +60,9 @@ author = 'The Zope & Plone developer community'
 # built documents.
 #
 # The short X.Y version.
-version = '7.4'
+version = '7.5'
 # The full version, including alpha/beta/rc tags.
-release = '7.4'
+release = '7.5'
 
 # The language for content autogenerated by Sphinx. Refer to documentation
 # for a list of supported languages.
@@ -112,7 +112,6 @@ todo_include_todos = True
 # Intersphinx Mapping for Links between different Documentations
 intersphinx_mapping = {
     'python3': ('https://docs.python.org/3', None),
-    'python38': ('https://docs.python.org/3.8', None),
     'python39': ('https://docs.python.org/3.9', None),
     'python310': ('https://docs.python.org/3.10', None),
     'python311': ('https://docs.python.org/3.11', None),

{restrictedpython-7.4 → restrictedpython-8.0}/docs/contributing/index.rst

@@ -98,7 +98,6 @@ A (modified style) Copy of all Abstract Grammar Definitions for the Python versi
 .. toctree::
    :maxdepth: 2
 
-   changes_from37to38
    changes_from38to39
    changes_from39to310
    changes_from310to311
@@ -236,12 +235,11 @@ Technical Backgrounds - Links to External Documentation
 
   * AST Grammar of Python (`Status of Python Versions`_)
 
+    * `Python 3.13 AST`_ (EOL 2029-10)
     * `Python 3.12 AST`_ (EOL 2028-10)
     * `Python 3.11 AST`_ (EOL 2027-10)
     * `Python 3.10 AST`_ (EOL 2026-10)
     * `Python 3.9 AST`_ (EOL 2025-10)
-    * `Python 3.8 AST`_ (EOL 2024-10)
-    * `Python 3.7 AST`_ (EOL 2023-06-27)
 
   * `AST NodeVistiors Class`_
   * `AST NodeTransformer Class`_
@@ -259,6 +257,8 @@ Todos
 
 .. _`What's new in Python`: https://docs.python.org/3/whatsnew/
 
+.. _`What's new in Python 3.13`: https://docs.python.org/3.13/whatsnew/3.13.html
+
 .. _`What's new in Python 3.12`: https://docs.python.org/3.12/whatsnew/3.12.html
 
 .. _`What's new in Python 3.11`: https://docs.python.org/3.11/whatsnew/3.11.html
@@ -267,10 +267,6 @@ Todos
 
 .. _`What's new in Python 3.9`: https://docs.python.org/3.9/whatsnew/3.9.html
 
-.. _`What's new in Python 3.8`: https://docs.python.org/3.8/whatsnew/3.8.html
-
-.. _`What's new in Python 3.7`: https://docs.python.org/3.7/whatsnew/3.7.html
-
 .. _`Status of Python Versions`: https://devguide.python.org/versions/
 
 .. _`Concept of Immutable Types and Python Example`: https://en.wikipedia.org/wiki/Immutable_object#Python
@@ -285,6 +281,8 @@ Todos
 
 .. _`Python 3 AST`: https://docs.python.org/3/library/ast.html#abstract-grammar
 
+.. _`Python 3.13 AST`: https://docs.python.org/3.13/library/ast.html#abstract-grammar
+
 .. _`Python 3.12 AST`: https://docs.python.org/3.12/library/ast.html#abstract-grammar
 
 .. _`Python 3.11 AST`: https://docs.python.org/3.11/library/ast.html#abstract-grammar
@@ -293,10 +291,6 @@ Todos
 
 .. _`Python 3.9 AST`: https://docs.python.org/3.9/library/ast.html#abstract-grammar
 
-.. _`Python 3.8 AST`: https://docs.python.org/3.8/library/ast.html#abstract-grammar
-
-.. _`Python 3.7 AST`: https://docs.python.org/3.7/library/ast.html#abstract-grammar
-
 .. _`AST NodeVistiors Class`: https://docs.python.org/3/library/ast.html#ast.NodeVisitor
 
 .. _`AST NodeTransformer Class`: https://docs.python.org/3/library/ast.html#ast.NodeTransformer

{restrictedpython-7.4 → restrictedpython-8.0}/docs/index.rst

@@ -15,7 +15,7 @@ RestrictedPython is not a sandbox system or a secured environment, but it helps
 Supported Python versions
 =========================
 
-RestrictedPython supports CPython 3.7 up to 3.12.
+RestrictedPython supports CPython 3.9 up to 3.13.
 It does _not_ support PyPy or other alternative Python implementations.
 
 Contents

{restrictedpython-7.4 → restrictedpython-8.0}/pyproject.toml

@@ -3,7 +3,7 @@
 # https://github.com/zopefoundation/meta/tree/master/config/pure-python
 
 [build-system]
-requires = ["setuptools<74"]
+requires = ["setuptools <= 75.6.0"]
 build-backend = "setuptools.build_meta"
 
 [tool.coverage.run]
@@ -11,7 +11,7 @@ branch = true
 source = ["RestrictedPython"]
 
 [tool.coverage.report]
-fail_under = 97.9
+fail_under = 97.3
 precision = 2
 ignore_errors = true
 show_missing = true

{restrictedpython-7.4 → restrictedpython-8.0}/setup.py

@@ -25,9 +25,9 @@ def read(*rnames):
 
 
 setup(name='RestrictedPython',
-      version='7.4',
+      version='8.0',
       url='https://github.com/zopefoundation/RestrictedPython',
-      license='ZPL 2.1',
+      license='ZPL-2.1',
       description=(
           'RestrictedPython is a defined subset of the Python language which '
           'allows to provide a program input into a trusted environment.'),
@@ -39,7 +39,6 @@ setup(name='RestrictedPython',
           'Programming Language :: Python',
           'Operating System :: OS Independent',
           'Programming Language :: Python :: 3',
-          'Programming Language :: Python :: 3.8',
           'Programming Language :: Python :: 3.9',
           'Programming Language :: Python :: 3.10',
           'Programming Language :: Python :: 3.11',
@@ -60,7 +59,7 @@ setup(name='RestrictedPython',
       packages=find_packages('src'),
       package_dir={'': 'src'},
       install_requires=[],
-      python_requires=">=3.8, <3.14",
+      python_requires=">=3.9, <3.14",
       extras_require={
           'test': ['pytest', 'pytest-mock'],
           'docs': ['Sphinx', 'furo'],

{restrictedpython-7.4 → restrictedpython-8.0}/src/RestrictedPython/Guards.py

@@ -17,7 +17,6 @@
 
 import builtins
 
-from RestrictedPython._compat import IS_PY311_OR_GREATER
 from RestrictedPython.transformer import INSPECT_ATTRIBUTES
 
 
@@ -106,9 +105,6 @@ _safe_exceptions = [
     'ZeroDivisionError',
 ]
 
-if IS_PY311_OR_GREATER:
-    _safe_exceptions.append("ExceptionGroup")
-
 for name in _safe_names:
     safe_builtins[name] = getattr(builtins, name)
 

{restrictedpython-7.4 → restrictedpython-8.0}/src/RestrictedPython/transformer.py

@@ -1141,8 +1141,8 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
         return self.node_contents_visit(node)
 
     def visit_TryStar(self, node):
-        """Allow `ExceptionGroup` without restrictions."""
-        return self.node_contents_visit(node)
+        """Disallow `ExceptionGroup` due to a potential sandbox escape."""
+        self.not_allowed(node)
 
     def visit_ExceptHandler(self, node):
         """Protect exception handlers."""

{restrictedpython-7.4 → restrictedpython-8.0}/src/RestrictedPython.egg-info/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.1
 Name: RestrictedPython
-Version: 7.4
+Version: 8.0
 Summary: RestrictedPython is a defined subset of the Python language which allows to provide a program input into a trusted environment.
 Home-page: https://github.com/zopefoundation/RestrictedPython
 Author: Zope Foundation and Contributors
 Author-email: zope-dev@zope.dev
-License: ZPL 2.1
+License: ZPL-2.1
 Project-URL: Documentation, https://restrictedpython.readthedocs.io/
 Project-URL: Source, https://github.com/zopefoundation/RestrictedPython
 Project-URL: Tracker, https://github.com/zopefoundation/RestrictedPython/issues
@@ -15,7 +15,6 @@ Classifier: License :: OSI Approved :: Zope Public License
 Classifier: Programming Language :: Python
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
@@ -23,7 +22,7 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Topic :: Security
-Requires-Python: >=3.8, <3.14
+Requires-Python: >=3.9, <3.14
 Description-Content-Type: text/x-rst
 License-File: LICENSE.txt
 Provides-Extra: test
@@ -124,6 +123,27 @@ the documentation `Contributing page
 Changes
 =======
 
+8.0 (2025-01-23)
+----------------
+
+Backwards incompatible changes
+++++++++++++++++++++++++++++++
+
+- Disallow ``try/except*`` clauses due to a possible sandbox escape and
+  probable uselessness of this feature in the context of ``RestrictedPython``.
+  In addition, remove ``ExceptionGroup`` from ``safe_builtins`` (as useful only
+  with ``try/except*``). - This feature was introduced into
+  ``RestrictedPython`` in version 6.0 for Python 3.11+. (CVE-2025-22153)
+
+- Drop support for Python 3.8.
+
+Features
+++++++++
+
+- Update setuptools version pin.
+  (`#292 <https://github.com/zopefoundation/RestrictedPython/issues/292>`_)
+
+
 7.4 (2024-10-09)
 ----------------
 

{restrictedpython-7.4 → restrictedpython-8.0}/src/RestrictedPython.egg-info/SOURCES.txt

@@ -20,30 +20,9 @@ docs/index.rst
 docs/logo.jpg
 docs/make.bat
 docs/requirements.txt
-docs/_build/doctest/output.txt
-docs/_build/html/_images/logo.jpg
-docs/_build/html/_sources/changes.rst.txt
-docs/_build/html/_sources/idea.rst.txt
-docs/_build/html/_sources/index.rst.txt
-docs/_build/html/_sources/contributing/changes_from310to311.rst.txt
-docs/_build/html/_sources/contributing/changes_from311to312.rst.txt
-docs/_build/html/_sources/contributing/changes_from312to313.rst.txt
-docs/_build/html/_sources/contributing/changes_from37to38.rst.txt
-docs/_build/html/_sources/contributing/changes_from38to39.rst.txt
-docs/_build/html/_sources/contributing/changes_from39to310.rst.txt
-docs/_build/html/_sources/contributing/index.rst.txt
-docs/_build/html/_sources/install/index.rst.txt
-docs/_build/html/_sources/roadmap/index.rst.txt
-docs/_build/html/_sources/usage/api.rst.txt
-docs/_build/html/_sources/usage/basic_usage.rst.txt
-docs/_build/html/_sources/usage/framework_usage.rst.txt
-docs/_build/html/_sources/usage/index.rst.txt
-docs/_build/html/_sources/usage/policy.rst.txt
-docs/_build/html/_static/scripts/furo.js.LICENSE.txt
 docs/contributing/changes_from310to311.rst
 docs/contributing/changes_from311to312.rst
 docs/contributing/changes_from312to313.rst
-docs/contributing/changes_from37to38.rst
 docs/contributing/changes_from38to39.rst
 docs/contributing/changes_from39to310.rst
 docs/contributing/index.rst
@@ -51,7 +30,6 @@ docs/contributing/ast/python3_10.ast
 docs/contributing/ast/python3_11.ast
 docs/contributing/ast/python3_12.ast
 docs/contributing/ast/python3_13.ast
-docs/contributing/ast/python3_7.ast
 docs/contributing/ast/python3_8.ast
 docs/contributing/ast/python3_9.ast
 docs/install/index.rst

{restrictedpython-7.4 → restrictedpython-8.0}/tests/transformer/test_try.py

@@ -68,19 +68,13 @@ def try_except_star(m):
     not IS_PY311_OR_GREATER,
     reason="ExceptionGroup class was added in Python 3.11.",
 )
-def test_RestrictingNodeTransformer__visit_TryStar__1(mocker):
-    """It allows try-except* PEP 654 statements."""
-    trace = mocker.stub()
-    restricted_exec(TRY_EXCEPT_STAR)['try_except_star'](trace)
-
-    trace.assert_has_calls([
-        mocker.call('try'),
-        mocker.call('IndentationError'),
-        mocker.call('ValueError')
-    ])
-
-    with pytest.raises(AssertionError):
-        trace.assert_has_calls([mocker.call('RuntimeError')])
+def test_RestrictingNodeTransformer__visit_TryStar__1():
+    """It denies try-except* PEP 654 statements."""
+    result = compile_restricted_exec(TRY_EXCEPT_STAR)
+    assert result.errors == (
+        'Line 3: TryStar statements are not allowed.',
+    )
+    assert result.code is None
 
 
 TRY_FINALLY = """

{restrictedpython-7.4 → restrictedpython-8.0}/tox.ini

@@ -5,7 +5,6 @@ minversion = 3.18
 envlist =
     release-check
     lint
-    py38
     py39
     py310
     py311
@@ -21,7 +20,7 @@ usedevelop = true
 package = wheel
 wheel_build_env = .pkg
 deps =
-    setuptools  <74
+    setuptools <= 75.6.0
     datetime: DateTime
     -cconstraints.txt
     pytest-cov
@@ -50,7 +49,7 @@ commands =
     coverage combine
     coverage html
     coverage report -m --fail-under=100
-depends = py38,py39,py310,py311,py311-datetime,py312,py313,coverage
+depends = py39,py310,py311,py311-datetime,py312,py313,coverage
 
 [testenv:setuptools-latest]
 basepython = python3
@@ -65,7 +64,7 @@ description = ensure that the distribution is ready to release
 basepython = python3
 skip_install = true
 deps =
-    setuptools <74
+    setuptools <= 75.6.0
     twine
     build
     check-manifest

restrictedpython-7.4/docs/_build/doctest/output.txt

@@ -1,35 +0,0 @@
-Results of doctest builder run on 2024-10-09 09:56:01
-=====================================================
-
-Document: usage/api
--------------------
-1 items passed all tests:
-  13 tests in default
-13 tests in 1 items.
-13 passed and 0 failed.
-Test passed.
-
-Document: usage/basic_usage
----------------------------
-2 items passed all tests:
-   6 tests in default
-   1 tests in single
-7 tests in 2 items.
-7 passed and 0 failed.
-Test passed.
-
-Document: usage/framework_usage
--------------------------------
-2 items passed all tests:
-   1 tests in default
-   2 tests in own_policy
-3 tests in 2 items.
-3 passed and 0 failed.
-Test passed.
-
-Doctest summary
-===============
-   23 tests
-    0 failures in tests
-    0 failures in setup code
-    0 failures in cleanup code

restrictedpython-7.4/docs/_build/html/_sources/changes.rst.txt

@@ -1 +0,0 @@
-.. include:: ../CHANGES.rst

restrictedpython-7.4/docs/_build/html/_sources/contributing/changes_from310to311.rst.txt

@@ -1,5 +0,0 @@
-Changes from Python 3.10 to Python 3.11
----------------------------------------
-
-.. literalinclude:: ast/python3_11.ast
-   :diff: ast/python3_10.ast

restrictedpython-7.4/docs/_build/html/_sources/contributing/changes_from311to312.rst.txt

@@ -1,5 +0,0 @@
-Changes from Python 3.11 to Python 3.12
----------------------------------------
-
-.. literalinclude:: ast/python3_12.ast
-   :diff: ast/python3_11.ast

restrictedpython-7.4/docs/_build/html/_sources/contributing/changes_from312to313.rst.txt

@@ -1,5 +0,0 @@
-Changes from Python 3.12 to Python 3.13
----------------------------------------
-
-.. literalinclude:: ast/python3_13.ast
-   :diff: ast/python3_12.ast

restrictedpython-7.4/docs/_build/html/_sources/contributing/changes_from37to38.rst.txt

@@ -1,5 +0,0 @@
-Changes from Python 3.7 to Python 3.8
--------------------------------------
-
-.. literalinclude:: ast/python3_8.ast
-   :diff: ast/python3_7.ast

restrictedpython-7.4/docs/_build/html/_sources/contributing/changes_from38to39.rst.txt

@@ -1,5 +0,0 @@
-Changes from Python 3.8 to Python 3.9
--------------------------------------
-
-.. literalinclude:: ast/python3_9.ast
-   :diff: ast/python3_8.ast

restrictedpython-7.4/docs/_build/html/_sources/contributing/changes_from39to310.rst.txt

@@ -1,5 +0,0 @@
-Changes from Python 3.9 to Python 3.10
---------------------------------------
-
-.. literalinclude:: ast/python3_10.ast
-   :diff: ast/python3_9.ast