simpleeval 1.0.7__tar.gz → 1.0.8__tar.gz

{simpleeval-1.0.7 → simpleeval-1.0.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: simpleeval
-Version: 1.0.7
+Version: 1.0.8
 Summary: A simple, safe single expression evaluator library.
 Project-URL: Source code, https://github.com/danthedeckie/simpleeval
 Author-email: Daniel Fairhead <danthedeckie@gmail.com>
@@ -556,7 +556,7 @@ The initial idea came from J.F. Sebastian on Stack Overflow
 ( http://stackoverflow.com/a/9558001/1973500 ) with modifications and many improvements,
 see the head of the main file for contributors list.
 
-Please read the ``test_simpleeval.py`` file for other potential gotchas or
+Please read the ``tests/`` for other potential gotchas or
 details.  I'm very happy to accept pull requests, suggestions, or other issues.
 Enjoy!
 
@@ -573,7 +573,7 @@ Or to set the tests running on every file change:
 
 (requires ``entr``) 
 
-I'm trying to keep the codebase relatively clean with Black, isort, pylint & mypy.
+I'm trying to keep the codebase relatively clean with ruff, & mypy.
 See::
 
     $ make format
@@ -582,6 +582,8 @@ and::
 
     $ make lint
 
+You can run tests against python versions 3.9-3.14 via `tox` (if you have them installed)
+
 BEWARE
 ------
 

{simpleeval-1.0.7 → simpleeval-1.0.8}/README.rst

@@ -539,7 +539,7 @@ The initial idea came from J.F. Sebastian on Stack Overflow
 ( http://stackoverflow.com/a/9558001/1973500 ) with modifications and many improvements,
 see the head of the main file for contributors list.
 
-Please read the ``test_simpleeval.py`` file for other potential gotchas or
+Please read the ``tests/`` for other potential gotchas or
 details.  I'm very happy to accept pull requests, suggestions, or other issues.
 Enjoy!
 
@@ -556,7 +556,7 @@ Or to set the tests running on every file change:
 
 (requires ``entr``) 
 
-I'm trying to keep the codebase relatively clean with Black, isort, pylint & mypy.
+I'm trying to keep the codebase relatively clean with ruff, & mypy.
 See::
 
     $ make format
@@ -565,6 +565,8 @@ and::
 
     $ make lint
 
+You can run tests against python versions 3.9-3.14 via `tox` (if you have them installed)
+
 BEWARE
 ------
 

{simpleeval-1.0.7 → simpleeval-1.0.8}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simpleeval"
-version = "1.0.7"
+version = "1.0.8"
 requires-python = ">=3.9"
 readme = "README.rst"
 description = "A simple, safe single expression evaluator library."
@@ -27,6 +27,15 @@ dependencies = []
 [project.urls]
 "Source code" = "https://github.com/danthedeckie/simpleeval"
 
+[dependency-groups]
+dev = [
+    "hatch>=1.15.1",
+    "mypy>=1.19.1",
+    "ruff>=0.16.1",
+    "tox>=4.30.3",
+    "twine>=6.2.0",
+]
+
 [pycodestyle]
 max_line_length = 99
 
@@ -37,7 +46,7 @@ build-backend = "hatchling.build"
 [tool.hatch.build.targets.sdist]
 include = [
     "simpleeval.py",
-    "test_simpleeval.py",
+    "tests/*.py",
     "README.rst",
     "LICENCE",
 ]
@@ -50,9 +59,6 @@ path = "simpleeval.py"
 packages = ["simpleeval.py"]
 core-metadata-version = "2.3"
 
-[tool.hatch.envs.hatch-test]
-default-args = ["test_simpleeval.py"]
-
 [tool.black]
 line-length = 99
 target-version = ['py310']
@@ -81,3 +87,16 @@ disable = [
     "unnecessary-pass",
     "bad-super-call",
 ]
+
+[tool.uv]
+required-version = ">=0.12.1"
+
+[tool.tox]
+env_list = ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14", "lint"]
+
+[tool.tox.env_run_base]
+commands = [["python", "-Werror", "-m", "unittest"]]
+
+[tool.tox.env.lint]
+commands = [["make", "lint"]]
+allowlist_externals = ["make"]

{simpleeval-1.0.7 → simpleeval-1.0.8}/simpleeval.py

@@ -2,7 +2,7 @@
 SimpleEval - (C) 2013-2026 Daniel Fairhead
 -------------------------------------
 
-An short, easy to use, safe and reasonably extensible expression evaluator.
+A short, easy to use, safe and reasonably extensible expression evaluator.
 Designed for things like in a website where you want to allow the user to
 generate a string, or a number from some other input, without allowing full
 eval() or other unsafe or needlessly complex linguistics.
@@ -65,6 +65,9 @@ Contributors:
 - decorator-factory <decorator-factory@protonmail.com> More security fixes
 - lkruitwagen (Lucas Kruitwagen) Adding support for dict comprehensions
 - ByamB4 (Byambadalai) Reported breakout via module & disallowed functions as object attrs
+- Charles Vosburgh Reported & tested dangerous functions in `os`
+- Tradi3 (github.com/krutftw) Reported escape via operator module functions
+- arpitjain099 (Arpit Jain) Reported missing set & frozenset for names
 
 -------------------------------------
 Basic Usage:
@@ -104,6 +107,8 @@ well:
 
 """
 
+from __future__ import annotations
+
 import ast
 import operator as op
 import os
@@ -111,7 +116,6 @@ import sys
 import types
 import warnings
 from random import random
-from typing import Type, Dict, Set, Union
 
 ########################################
 # Module wide 'globals'
@@ -162,6 +166,10 @@ DISALLOW_FUNCTIONS = {
     locals,
     os.popen,
     os.system,
+    *(getattr(os, func) for func in dir(os) if func.startswith(("exec", "spawn", "posix_spawn"))),
+    op.attrgetter,
+    op.itemgetter,
+    op.methodcaller,
 }
 if hasattr(__builtins__, "help") or (
     hasattr(__builtins__, "__contains__") and "help" in __builtins__  # type: ignore
@@ -169,9 +177,12 @@ if hasattr(__builtins__, "help") or (
     # PyInstaller environment doesn't include this module.
     DISALLOW_FUNCTIONS.add(help)
 
+if hasattr(op, "call"):
+    DISALLOW_FUNCTIONS.add(op.call)
+
 # Opt-in type safety experiment. Will be opt-out in 2.x
 
-BASIC_ALLOWED_ATTRS: Dict[Union[Type, None], Set] = {
+BASIC_ALLOWED_ATTRS: dict[type | None, set] = {
     int: {
         "as_integer_ratio",
         "bit_length",
@@ -313,17 +324,13 @@ class TypeNotSpecified(Exception):
 class InvalidExpression(Exception):
     """Generic Exception"""
 
-    pass
-
 
 class FunctionNotDefined(InvalidExpression):
     """sorry! That function isn't defined!"""
 
     def __init__(self, func_name, expression):
-        self.message = "Function '{0}' not defined, for expression '{1}'.".format(
-            func_name, expression
-        )
-        setattr(self, "func_name", func_name)  # bypass 2to3 confusion.
+        self.message = f"Function '{func_name}' not defined, for expression '{expression}'."
+        self.func_name = func_name  # bypass 2to3 confusion.
         self.expression = expression
 
         super(InvalidExpression, self).__init__(self.message)
@@ -334,7 +341,7 @@ class NameNotDefined(InvalidExpression):
 
     def __init__(self, name, expression):
         self.name = name
-        self.message = "'{0}' is not defined for expression '{1}'".format(name, expression)
+        self.message = f"'{name}' is not defined for expression '{expression}'"
         self.expression = expression
 
         super(InvalidExpression, self).__init__(self.message)
@@ -344,9 +351,7 @@ class AttributeDoesNotExist(InvalidExpression):
     """attribute does not exist"""
 
     def __init__(self, attr, expression):
-        self.message = "Attribute '{0}' does not exist in expression '{1}'".format(
-            attr, expression
-        )
+        self.message = f"Attribute '{attr}' does not exist in expression '{expression}'"
         self.attr = attr
         self.expression = expression
 
@@ -357,7 +362,7 @@ class OperatorNotDefined(InvalidExpression):
     """operator does not exist"""
 
     def __init__(self, attr, expression):
-        self.message = "Operator '{0}' does not exist in expression '{1}'".format(attr, expression)
+        self.message = f"Operator '{attr}' does not exist in expression '{expression}'"
         self.attr = attr
         self.expression = expression
 
@@ -367,33 +372,23 @@ class OperatorNotDefined(InvalidExpression):
 class FeatureNotAvailable(InvalidExpression):
     """What you're trying to do is not allowed."""
 
-    pass
-
 
 class NumberTooHigh(InvalidExpression):
     """Sorry! That number is too high. I don't want to spend the
     next 10 years evaluating this expression!"""
 
-    pass
-
 
 class IterableTooLong(InvalidExpression):
     """That iterable is **way** too long, baby."""
 
-    pass
-
 
 class AssignmentAttempted(UserWarning):
     """Assignment not allowed in SimpleEval"""
 
-    pass
-
 
 class MultipleExpressions(UserWarning):
     """Only the first expression parsed will be used"""
 
-    pass
-
 
 # Sentinal used during attr access
 _ATTR_NOT_FOUND = object()
@@ -457,7 +452,7 @@ def safe_power(a, b):  # pylint: disable=invalid-name
     """a limited exponent/to-the-power-of function, for safety reasons"""
 
     if abs(a) > MAX_POWER or abs(b) > MAX_POWER:
-        raise NumberTooHigh("Sorry! I don't want to evaluate {0} ** {1}".format(a, b))
+        raise NumberTooHigh(f"Sorry! I don't want to evaluate {a} ** {b}")
     return a**b
 
 
@@ -475,25 +470,22 @@ def safe_mult(a, b):  # pylint: disable=invalid-name
 def safe_add(a, b):  # pylint: disable=invalid-name
     """iterable length limit again"""
 
-    if hasattr(a, "__len__") and hasattr(b, "__len__"):
-        if len(a) + len(b) > MAX_STRING_LENGTH:
-            raise IterableTooLong(
-                "Sorry, adding those two together would make something too long."
-            )
+    if hasattr(a, "__len__") and hasattr(b, "__len__") and len(a) + len(b) > MAX_STRING_LENGTH:
+        raise IterableTooLong("Sorry, adding those two together would make something too long.")
     return a + b
 
 
 def safe_rshift(a, b):  # pylint: disable=invalid-name
     """rshift, but with input limits"""
     if abs(b) > MAX_SHIFT or abs(a) > MAX_SHIFT_BASE:
-        raise NumberTooHigh("Sorry! I don't want to evaluate {0} >> {1}".format(a, b))
+        raise NumberTooHigh(f"Sorry! I don't want to evaluate {a} >> {b}")
     return a >> b
 
 
 def safe_lshift(a, b):  # pylint: disable=invalid-name
     """lshift, but with input limits"""
     if abs(b) > MAX_SHIFT or abs(a) > MAX_SHIFT_BASE:
-        raise NumberTooHigh("Sorry! I don't want to evaluate {0} << {1}".format(a, b))
+        raise NumberTooHigh(f"Sorry! I don't want to evaluate {a} << {b}")
     return a << b
 
 
@@ -546,7 +538,7 @@ ATTR_INDEX_FALLBACK = True
 # And the actual evaluator:
 
 
-class SimpleEval(object):  # pylint: disable=too-few-public-methods
+class SimpleEval:  # pylint: disable=too-few-public-methods
     """A very simple expression parser.
     >>> s = SimpleEval()
     >>> s.eval("20 + 30 - ( 10 * 5)")
@@ -615,7 +607,7 @@ class SimpleEval(object):  # pylint: disable=too-few-public-methods
 
         for f in self.functions.values():
             if f in DISALLOW_FUNCTIONS:
-                raise FeatureNotAvailable("This function {} is a really bad idea.".format(f))
+                raise FeatureNotAvailable(f"This function {f} is a really bad idea.")
 
     def __del__(self):
         self.nodes = None
@@ -637,7 +629,7 @@ class SimpleEval(object):  # pylint: disable=too-few-public-methods
         if isinstance(item, types.ModuleType):
             raise FeatureNotAvailable("Sorry, modules are not allowed")
 
-        if isinstance(item, (list, tuple)):
+        if isinstance(item, (list, tuple, set, frozenset)):
             for element in item:
                 self._check_disallowed_items(element)
         elif isinstance(item, dict):
@@ -656,7 +648,7 @@ class SimpleEval(object):  # pylint: disable=too-few-public-methods
             raise InvalidExpression("Sorry, cannot evaluate empty string")
         if len(parsed.body) > 1:
             warnings.warn(
-                "'{}' contains multiple expressions. Only the first will be used.".format(expr),
+                f"'{expr}' contains multiple expressions. Only the first will be used.",
                 MultipleExpressions,
             )
         return parsed.body[0]
@@ -677,7 +669,7 @@ class SimpleEval(object):  # pylint: disable=too-few-public-methods
             handler = self.nodes[type(node)]
         except KeyError:
             raise FeatureNotAvailable(
-                "Sorry, {0} is not available in this evaluator".format(type(node).__name__)
+                f"Sorry, {type(node).__name__} is not available in this evaluator"
             )
 
         result = handler(node)
@@ -689,13 +681,13 @@ class SimpleEval(object):  # pylint: disable=too-few-public-methods
 
     def _eval_assign(self, node):
         warnings.warn(
-            "Assignment ({}) attempted, but this is ignored".format(self.expr), AssignmentAttempted
+            f"Assignment ({self.expr}) attempted, but this is ignored", AssignmentAttempted
         )
         return self._eval(node.value)
 
     def _eval_aug_assign(self, node):
         warnings.warn(
-            "Assignment ({}) attempted, but this is ignored".format(self.expr), AssignmentAttempted
+            f"Assignment ({self.expr}) attempted, but this is ignored", AssignmentAttempted
         )
         return self._eval(node.value)
 
@@ -711,9 +703,7 @@ class SimpleEval(object):  # pylint: disable=too-few-public-methods
     def _eval_str(node):
         if len(node.s) > MAX_STRING_LENGTH:
             raise IterableTooLong(
-                "String Literal in statement is too long! ({0}, when {1} is max)".format(
-                    len(node.s), MAX_STRING_LENGTH
-                )
+                f"String Literal in statement is too long! ({len(node.s)}, when {MAX_STRING_LENGTH} is max)"
             )
         return node.s
 
@@ -721,9 +711,7 @@ class SimpleEval(object):  # pylint: disable=too-few-public-methods
     def _eval_constant(node):
         if hasattr(node.value, "__len__") and len(node.value) > MAX_STRING_LENGTH:
             raise IterableTooLong(
-                "Literal in statement is too long! ({0}, when {1} is max)".format(
-                    len(node.value), MAX_STRING_LENGTH
-                )
+                f"Literal in statement is too long! ({len(node.value)}, when {MAX_STRING_LENGTH} is max)"
             )
         return node.value
 
@@ -809,9 +797,7 @@ class SimpleEval(object):  # pylint: disable=too-few-public-methods
                 pass
         elif not hasattr(self.names, "__getitem__"):
             raise InvalidExpression(
-                'Trying to use name (variable) "{0}" when no "names" defined for evaluator'.format(
-                    node.id
-                )
+                f'Trying to use name (variable) "{node.id}" when no "names" defined for evaluator'
             )
 
         if node.id in self.functions:
@@ -834,12 +820,10 @@ class SimpleEval(object):  # pylint: disable=too-few-public-methods
                 raise FeatureNotAvailable(
                     "Sorry, access to __attributes "
                     " or func_ attributes is not available. "
-                    "({0})".format(node.attr)
+                    f"({node.attr})"
                 )
         if node.attr in DISALLOW_METHODS:
-            raise FeatureNotAvailable(
-                "Sorry, this method is not available. ({0})".format(node.attr)
-            )
+            raise FeatureNotAvailable(f"Sorry, this method is not available. ({node.attr})")
 
         # Evaluate "node" - the thing that we're trying to access an attr of first:
         node_evaluated = self._eval(node.value)
@@ -923,7 +907,7 @@ class EvalWithCompoundTypes(SimpleEval):
     _max_count = 0
 
     def __init__(self, operators=None, functions=None, names=None, allowed_attrs=None):
-        super(EvalWithCompoundTypes, self).__init__(operators, functions, names, allowed_attrs)
+        super().__init__(operators, functions, names, allowed_attrs)
 
         self.functions.update(list=list, tuple=tuple, dict=dict, set=set)
 
@@ -942,7 +926,7 @@ class EvalWithCompoundTypes(SimpleEval):
     def eval(self, expr, previously_parsed=None):
         # reset _max_count for each eval run
         self._max_count = 0
-        return super(EvalWithCompoundTypes, self).eval(expr, previously_parsed)
+        return super().eval(expr, previously_parsed)
 
     def _eval_dict(self, node):
         result = {}
@@ -971,7 +955,7 @@ class EvalWithCompoundTypes(SimpleEval):
         return tuple(self._eval(x) for x in node.elts)
 
     def _eval_set(self, node):
-        return set(self._eval(x) for x in node.elts)
+        return {self._eval(x) for x in node.elts}
 
     def _eval_comprehension(self, node):
         if isinstance(node, ast.DictComp):

simpleeval-1.0.8/tests/base.py

@@ -0,0 +1,18 @@
+import unittest
+
+from simpleeval import (
+    SimpleEval,
+)
+
+
+class DRYTest(unittest.TestCase):
+    """Stuff we need to do every test, let's do here instead..
+    Don't Repeat Yourself."""
+
+    def setUp(self):
+        """initialize a SimpleEval"""
+        self.s = SimpleEval()
+
+    def t(self, expr, should_be):  # pylint: disable=invalid-name
+        """test an evaluation of an expression against an expected answer"""
+        return self.assertEqual(self.s.eval(expr), should_be)

simpleeval-1.0.8/tests/test_allowed_attributes.py

@@ -0,0 +1,76 @@
+import simpleeval
+from simpleeval import BASIC_ALLOWED_ATTRS, FeatureNotAvailable, simple_eval
+
+from .base import DRYTest
+
+
+class TestAllowedAttributes(DRYTest):
+    def setUp(self):
+        self.saved_disallow_methods = simpleeval.DISALLOW_METHODS
+        simpleeval.DISALLOW_METHODS = []
+        super().setUp()
+
+    def tearDown(self) -> None:
+        simpleeval.DISALLOW_METHODS = self.saved_disallow_methods
+        return super().tearDown()
+
+    def test_allowed_attrs_(self):
+        self.s.allowed_attrs = BASIC_ALLOWED_ATTRS
+        self.t("5 + 5", 10)
+        self.t('"   hello  ".strip()', "hello")
+
+    def test_allowed_extra_attr(self):
+        class Foo:
+            def bar(self):
+                return 42
+
+        assert Foo().bar() == 42
+
+        extended_attrs = BASIC_ALLOWED_ATTRS.copy()
+        extended_attrs[Foo] = {"bar"}
+
+        simple_eval("foo.bar()", names={"foo": Foo()}, allowed_attrs=extended_attrs)
+
+    def test_disallowed_extra_attr(self):
+        class Foo:
+            bar = 42
+            hidden = 100
+
+        assert Foo().bar == 42
+
+        extended_attrs = BASIC_ALLOWED_ATTRS.copy()
+        extended_attrs[Foo] = {"bar"}
+
+        self.assertEqual(
+            simple_eval("foo.bar", names={"foo": Foo()}, allowed_attrs=extended_attrs), 42
+        )
+        with self.assertRaisesRegex(FeatureNotAvailable, r".*'\.hidden' access not allowed.*"):
+            self.assertEqual(
+                simple_eval("foo.hidden", names={"foo": Foo()}, allowed_attrs=extended_attrs), 42
+            )
+
+    def test_disallowed_types(self):
+        class Foo:
+            bar = 42
+
+        assert Foo().bar == 42
+
+        with self.assertRaises(FeatureNotAvailable):
+            simple_eval("foo.bar", names={"foo": Foo()}, allowed_attrs=BASIC_ALLOWED_ATTRS)
+
+    def test_breakout_via_generator(self):
+        # Thanks decorator-factory
+        class Foo:
+            def bar(self):
+                yield "Hello, world!"
+
+        # Test the generator does work - also adds the `yield` to codecov...
+        assert list(Foo().bar()) == ["Hello, world!"]
+
+        evil = "foo.bar().gi_frame.f_globals['__builtins__'].exec('raise RuntimeError(\"Oh no\")')"
+
+        extended_attrs = BASIC_ALLOWED_ATTRS.copy()
+        extended_attrs[Foo] = {"bar"}
+
+        with self.assertRaisesRegex(FeatureNotAvailable, r".*attempted to access `\.gi_frame`.*"):
+            simple_eval(evil, names={"foo": Foo()}, allowed_attrs=extended_attrs)