476 lines
16 KiB
Python
476 lines
16 KiB
Python
|
# -*- coding: utf-8 -*-
|
||
|
|
"""
|
||
|
|
jinja2.sandbox
|
||
|
|
~~~~~~~~~~~~~~
|
||
|
|
|
||
|
|
Adds a sandbox layer to Jinja as it was the default behavior in the old
|
||
|
|
Jinja 1 releases. This sandbox is slightly different from Jinja 1 as the
|
||
|
|
default behavior is easier to use.
|
||
|
|
|
||
|
|
The behavior can be changed by subclassing the environment.
|
||
|
|
|
||
|
|
:copyright: (c) 2017 by the Jinja Team.
|
||
|
|
:license: BSD.
|
||
|
|
"""
|
||
|
|
import types
|
||
|
|
import operator
|
||
|
|
from collections import Mapping
|
||
|
|
from jinja2.environment import Environment
|
||
|
|
from jinja2.exceptions import SecurityError
|
||
|
|
from jinja2._compat import string_types, PY2
|
||
|
|
from jinja2.utils import Markup
|
||
|
|
|
||
|
|
from markupsafe import EscapeFormatter
|
||
|
|
from string import Formatter
|
||
|
|
|
||
|
|
|
||
|
|
#: maximum number of items a range may produce
|
||
|
|
MAX_RANGE = 100000
|
||
|
|
|
||
|
|
#: attributes of function objects that are considered unsafe.
|
||
|
|
if PY2:
|
||
|
|
UNSAFE_FUNCTION_ATTRIBUTES = set(['func_closure', 'func_code', 'func_dict',
|
||
|
|
'func_defaults', 'func_globals'])
|
||
|
|
else:
|
||
|
|
# On versions > python 2 the special attributes on functions are gone,
|
||
|
|
# but they remain on methods and generators for whatever reason.
|
||
|
|
UNSAFE_FUNCTION_ATTRIBUTES = set()
|
||
|
|
|
||
|
|
|
||
|
|
#: unsafe method attributes. function attributes are unsafe for methods too
|
||
|
|
UNSAFE_METHOD_ATTRIBUTES = set(['im_class', 'im_func', 'im_self'])
|
||
|
|
|
||
|
|
#: unsafe generator attirbutes.
|
||
|
|
UNSAFE_GENERATOR_ATTRIBUTES = set(['gi_frame', 'gi_code'])
|
||
|
|
|
||
|
|
#: unsafe attributes on coroutines
|
||
|
|
UNSAFE_COROUTINE_ATTRIBUTES = set(['cr_frame', 'cr_code'])
|
||
|
|
|
||
|
|
#: unsafe attributes on async generators
|
||
|
|
UNSAFE_ASYNC_GENERATOR_ATTRIBUTES = set(['ag_code', 'ag_frame'])
|
||
|
|
|
||
|
|
import warnings
|
||
|
|
|
||
|
|
# make sure we don't warn in python 2.6 about stuff we don't care about
|
||
|
|
warnings.filterwarnings('ignore', 'the sets module', DeprecationWarning,
|
||
|
|
module='jinja2.sandbox')
|
||
|
|
|
||
|
|
from collections import deque
|
||
|
|
|
||
|
|
_mutable_set_types = (set,)
|
||
|
|
_mutable_mapping_types = (dict,)
|
||
|
|
_mutable_sequence_types = (list,)
|
||
|
|
|
||
|
|
|
||
|
|
# on python 2.x we can register the user collection types
|
||
|
|
try:
|
||
|
|
from UserDict import UserDict, DictMixin
|
||
|
|
from UserList import UserList
|
||
|
|
_mutable_mapping_types += (UserDict, DictMixin)
|
||
|
|
_mutable_set_types += (UserList,)
|
||
|
|
except ImportError:
|
||
|
|
pass
|
||
|
|
|
||
|
|
# if sets is still available, register the mutable set from there as well
|
||
|
|
try:
|
||
|
|
from sets import Set
|
||
|
|
_mutable_set_types += (Set,)
|
||
|
|
except ImportError:
|
||
|
|
pass
|
||
|
|
|
||
|
|
#: register Python 2.6 abstract base classes
|
||
|
|
from collections import MutableSet, MutableMapping, MutableSequence
|
||
|
|
_mutable_set_types += (MutableSet,)
|
||
|
|
_mutable_mapping_types += (MutableMapping,)
|
||
|
|
_mutable_sequence_types += (MutableSequence,)
|
||
|
|
|
||
|
|
|
||
|
|
_mutable_spec = (
|
||
|
|
(_mutable_set_types, frozenset([
|
||
|
|
'add', 'clear', 'difference_update', 'discard', 'pop', 'remove',
|
||
|
|
'symmetric_difference_update', 'update'
|
||
|
|
])),
|
||
|
|
(_mutable_mapping_types, frozenset([
|
||
|
|
'clear', 'pop', 'popitem', 'setdefault', 'update'
|
||
|
|
])),
|
||
|
|
(_mutable_sequence_types, frozenset([
|
||
|
|
'append', 'reverse', 'insert', 'sort', 'extend', 'remove'
|
||
|
|
])),
|
||
|
|
(deque, frozenset([
|
||
|
|
'append', 'appendleft', 'clear', 'extend', 'extendleft', 'pop',
|
||
|
|
'popleft', 'remove', 'rotate'
|
||
|
|
]))
|
||
|
|
)
|
||
|
|
|
||
|
|
|
||
|
|
class _MagicFormatMapping(Mapping):
|
||
|
|
"""This class implements a dummy wrapper to fix a bug in the Python
|
||
|
|
standard library for string formatting.
|
||
|
|
|
||
|
|
See https://bugs.python.org/issue13598 for information about why
|
||
|
|
this is necessary.
|
||
|
|
"""
|
||
|
|
|
||
|
|
def __init__(self, args, kwargs):
|
||
|
|
self._args = args
|
||
|
|
self._kwargs = kwargs
|
||
|
|
self._last_index = 0
|
||
|
|
|
||
|
|
def __getitem__(self, key):
|
||
|
|
if key == '':
|
||
|
|
idx = self._last_index
|
||
|
|
self._last_index += 1
|
||
|
|
try:
|
||
|
|
return self._args[idx]
|
||
|
|
except LookupError:
|
||
|
|
pass
|
||
|
|
key = str(idx)
|
||
|
|
return self._kwargs[key]
|
||
|
|
|
||
|
|
def __iter__(self):
|
||
|
|
return iter(self._kwargs)
|
||
|
|
|
||
|
|
def __len__(self):
|
||
|
|
return len(self._kwargs)
|
||
|
|
|
||
|
|
|
||
|
|
def inspect_format_method(callable):
|
||
|
|
if not isinstance(callable, (types.MethodType,
|
||
|
|
types.BuiltinMethodType)) or \
|
||
|
|
callable.__name__ != 'format':
|
||
|
|
return None
|
||
|
|
obj = callable.__self__
|
||
|
|
if isinstance(obj, string_types):
|
||
|
|
return obj
|
||
|
|
|
||
|
|
|
||
|
|
def safe_range(*args):
|
||
|
|
"""A range that can't generate ranges with a length of more than
|
||
|
|
MAX_RANGE items.
|
||
|
|
"""
|
||
|
|
rng = range(*args)
|
||
|
|
if len(rng) > MAX_RANGE:
|
||
|
|
raise OverflowError('range too big, maximum size for range is %d' %
|
||
|
|
MAX_RANGE)
|
||
|
|
return rng
|
||
|
|
|
||
|
|
|
||
|
|
def unsafe(f):
|
||
|
|
"""Marks a function or method as unsafe.
|
||
|
|
|
||
|
|
::
|
||
|
|
|
||
|
|
@unsafe
|
||
|
|
def delete(self):
|
||
|
|
pass
|
||
|
|
"""
|
||
|
|
f.unsafe_callable = True
|
||
|
|
return f
|
||
|
|
|
||
|
|
|
||
|
|
def is_internal_attribute(obj, attr):
|
||
|
|
"""Test if the attribute given is an internal python attribute. For
|
||
|
|
example this function returns `True` for the `func_code` attribute of
|
||
|
|
python objects. This is useful if the environment method
|
||
|
|
:meth:`~SandboxedEnvironment.is_safe_attribute` is overridden.
|
||
|
|
|
||
|
|
>>> from jinja2.sandbox import is_internal_attribute
|
||
|
|
>>> is_internal_attribute(str, "mro")
|
||
|
|
True
|
||
|
|
>>> is_internal_attribute(str, "upper")
|
||
|
|
False
|
||
|
|
"""
|
||
|
|
if isinstance(obj, types.FunctionType):
|
||
|
|
if attr in UNSAFE_FUNCTION_ATTRIBUTES:
|
||
|
|
return True
|
||
|
|
elif isinstance(obj, types.MethodType):
|
||
|
|
if attr in UNSAFE_FUNCTION_ATTRIBUTES or \
|
||
|
|
attr in UNSAFE_METHOD_ATTRIBUTES:
|
||
|
|
return True
|
||
|
|
elif isinstance(obj, type):
|
||
|
|
if attr == 'mro':
|
||
|
|
return True
|
||
|
|
elif isinstance(obj, (types.CodeType, types.TracebackType, types.FrameType)):
|
||
|
|
return True
|
||
|
|
elif isinstance(obj, types.GeneratorType):
|
||
|
|
if attr in UNSAFE_GENERATOR_ATTRIBUTES:
|
||
|
|
return True
|
||
|
|
elif hasattr(types, 'CoroutineType') and isinstance(obj, types.CoroutineType):
|
||
|
|
if attr in UNSAFE_COROUTINE_ATTRIBUTES:
|
||
|
|
return True
|
||
|
|
elif hasattr(types, 'AsyncGeneratorType') and isinstance(obj, types.AsyncGeneratorType):
|
||
|
|
if attr in UNSAFE_ASYNC_GENERATOR_ATTRIBUTES:
|
||
|
|
return True
|
||
|
|
return attr.startswith('__')
|
||
|
|
|
||
|
|
|
||
|
|
def modifies_known_mutable(obj, attr):
|
||
|
|
"""This function checks if an attribute on a builtin mutable object
|
||
|
|
(list, dict, set or deque) would modify it if called. It also supports
|
||
|
|
the "user"-versions of the objects (`sets.Set`, `UserDict.*` etc.) and
|
||
|
|
with Python 2.6 onwards the abstract base classes `MutableSet`,
|
||
|
|
`MutableMapping`, and `MutableSequence`.
|
||
|
|
|
||
|
|
>>> modifies_known_mutable({}, "clear")
|
||
|
|
True
|
||
|
|
>>> modifies_known_mutable({}, "keys")
|
||
|
|
False
|
||
|
|
>>> modifies_known_mutable([], "append")
|
||
|
|
True
|
||
|
|
>>> modifies_known_mutable([], "index")
|
||
|
|
False
|
||
|
|
|
||
|
|
If called with an unsupported object (such as unicode) `False` is
|
||
|
|
returned.
|
||
|
|
|
||
|
|
>>> modifies_known_mutable("foo", "upper")
|
||
|
|
False
|
||
|
|
"""
|
||
|
|
for typespec, unsafe in _mutable_spec:
|
||
|
|
if isinstance(obj, typespec):
|
||
|
|
return attr in unsafe
|
||
|
|
return False
|
||
|
|
|
||
|
|
|
||
|
|
class SandboxedEnvironment(Environment):
|
||
|
|
"""The sandboxed environment. It works like the regular environment but
|
||
|
|
tells the compiler to generate sandboxed code. Additionally subclasses of
|
||
|
|
this environment may override the methods that tell the runtime what
|
||
|
|
attributes or functions are safe to access.
|
||
|
|
|
||
|
|
If the template tries to access insecure code a :exc:`SecurityError` is
|
||
|
|
raised. However also other exceptions may occur during the rendering so
|
||
|
|
the caller has to ensure that all exceptions are caught.
|
||
|
|
"""
|
||
|
|
sandboxed = True
|
||
|
|
|
||
|
|
#: default callback table for the binary operators. A copy of this is
|
||
|
|
#: available on each instance of a sandboxed environment as
|
||
|
|
#: :attr:`binop_table`
|
||
|
|
default_binop_table = {
|
||
|
|
'+': operator.add,
|
||
|
|
'-': operator.sub,
|
||
|
|
'*': operator.mul,
|
||
|
|
'/': operator.truediv,
|
||
|
|
'//': operator.floordiv,
|
||
|
|
'**': operator.pow,
|
||
|
|
'%': operator.mod
|
||
|
|
}
|
||
|
|
|
||
|
|
#: default callback table for the unary operators. A copy of this is
|
||
|
|
#: available on each instance of a sandboxed environment as
|
||
|
|
#: :attr:`unop_table`
|
||
|
|
default_unop_table = {
|
||
|
|
'+': operator.pos,
|
||
|
|
'-': operator.neg
|
||
|
|
}
|
||
|
|
|
||
|
|
#: a set of binary operators that should be intercepted. Each operator
|
||
|
|
#: that is added to this set (empty by default) is delegated to the
|
||
|
|
#: :meth:`call_binop` method that will perform the operator. The default
|
||
|
|
#: operator callback is specified by :attr:`binop_table`.
|
||
|
|
#:
|
||
|
|
#: The following binary operators are interceptable:
|
||
|
|
#: ``//``, ``%``, ``+``, ``*``, ``-``, ``/``, and ``**``
|
||
|
|
#:
|
||
|
|
#: The default operation form the operator table corresponds to the
|
||
|
|
#: builtin function. Intercepted calls are always slower than the native
|
||
|
|
#: operator call, so make sure only to intercept the ones you are
|
||
|
|
#: interested in.
|
||
|
|
#:
|
||
|
|
#: .. versionadded:: 2.6
|
||
|
|
intercepted_binops = frozenset()
|
||
|
|
|
||
|
|
#: a set of unary operators that should be intercepted. Each operator
|
||
|
|
#: that is added to this set (empty by default) is delegated to the
|
||
|
|
#: :meth:`call_unop` method that will perform the operator. The default
|
||
|
|
#: operator callback is specified by :attr:`unop_table`.
|
||
|
|
#:
|
||
|
|
#: The following unary operators are interceptable: ``+``, ``-``
|
||
|
|
#:
|
||
|
|
#: The default operation form the operator table corresponds to the
|
||
|
|
#: builtin function. Intercepted calls are always slower than the native
|
||
|
|
#: operator call, so make sure only to intercept the ones you are
|
||
|
|
#: interested in.
|
||
|
|
#:
|
||
|
|
#: .. versionadded:: 2.6
|
||
|
|
intercepted_unops = frozenset()
|
||
|
|
|
||
|
|
def intercept_unop(self, operator):
|
||
|
|
"""Called during template compilation with the name of a unary
|
||
|
|
operator to check if it should be intercepted at runtime. If this
|
||
|
|
method returns `True`, :meth:`call_unop` is excuted for this unary
|
||
|
|
operator. The default implementation of :meth:`call_unop` will use
|
||
|
|
the :attr:`unop_table` dictionary to perform the operator with the
|
||
|
|
same logic as the builtin one.
|
||
|
|
|
||
|
|
The following unary operators are interceptable: ``+`` and ``-``
|
||
|
|
|
||
|
|
Intercepted calls are always slower than the native operator call,
|
||
|
|
so make sure only to intercept the ones you are interested in.
|
||
|
|
|
||
|
|
.. versionadded:: 2.6
|
||
|
|
"""
|
||
|
|
return False
|
||
|
|
|
||
|
|
|
||
|
|
def __init__(self, *args, **kwargs):
|
||
|
|
Environment.__init__(self, *args, **kwargs)
|
||
|
|
self.globals['range'] = safe_range
|
||
|
|
self.binop_table = self.default_binop_table.copy()
|
||
|
|
self.unop_table = self.default_unop_table.copy()
|
||
|
|
|
||
|
|
def is_safe_attribute(self, obj, attr, value):
|
||
|
|
"""The sandboxed environment will call this method to check if the
|
||
|
|
attribute of an object is safe to access. Per default all attributes
|
||
|
|
starting with an underscore are considered private as well as the
|
||
|
|
special attributes of internal python objects as returned by the
|
||
|
|
:func:`is_internal_attribute` function.
|
||
|
|
"""
|
||
|
|
return not (attr.startswith('_') or is_internal_attribute(obj, attr))
|
||
|
|
|
||
|
|
def is_safe_callable(self, obj):
|
||
|
|
"""Check if an object is safely callable. Per default a function is
|
||
|
|
considered safe unless the `unsafe_callable` attribute exists and is
|
||
|
|
True. Override this method to alter the behavior, but this won't
|
||
|
|
affect the `unsafe` decorator from this module.
|
||
|
|
"""
|
||
|
|
return not (getattr(obj, 'unsafe_callable', False) or
|
||
|
|
getattr(obj, 'alters_data', False))
|
||
|
|
|
||
|
|
def call_binop(self, context, operator, left, right):
|
||
|
|
"""For intercepted binary operator calls (:meth:`intercepted_binops`)
|
||
|
|
this function is executed instead of the builtin operator. This can
|
||
|
|
be used to fine tune the behavior of certain operators.
|
||
|
|
|
||
|
|
.. versionadded:: 2.6
|
||
|
|
"""
|
||
|
|
return self.binop_table[operator](left, right)
|
||
|
|
|
||
|
|
def call_unop(self, context, operator, arg):
|
||
|
|
"""For intercepted unary operator calls (:meth:`intercepted_unops`)
|
||
|
|
this function is executed instead of the builtin operator. This can
|
||
|
|
be used to fine tune the behavior of certain operators.
|
||
|
|
|
||
|
|
.. versionadded:: 2.6
|
||
|
|
"""
|
||
|
|
return self.unop_table[operator](arg)
|
||
|
|
|
||
|
|
def getitem(self, obj, argument):
|
||
|
|
"""Subscribe an object from sandboxed code."""
|
||
|
|
try:
|
||
|
|
return obj[argument]
|
||
|
|
except (TypeError, LookupError):
|
||
|
|
if isinstance(argument, string_types):
|
||
|
|
try:
|
||
|
|
attr = str(argument)
|
||
|
|
except Exception:
|
||
|
|
pass
|
||
|
|
else:
|
||
|
|
try:
|
||
|
|
value = getattr(obj, attr)
|
||
|
|
except AttributeError:
|
||
|
|
pass
|
||
|
|
else:
|
||
|
|
if self.is_safe_attribute(obj, argument, value):
|
||
|
|
return value
|
||
|
|
return self.unsafe_undefined(obj, argument)
|
||
|
|
return self.undefined(obj=obj, name=argument)
|
||
|
|
|
||
|
|
def getattr(self, obj, attribute):
|
||
|
|
"""Subscribe an object from sandboxed code and prefer the
|
||
|
|
attribute. The attribute passed *must* be a bytestring.
|
||
|
|
"""
|
||
|
|
try:
|
||
|
|
value = getattr(obj, attribute)
|
||
|
|
except AttributeError:
|
||
|
|
try:
|
||
|
|
return obj[attribute]
|
||
|
|
except (TypeError, LookupError):
|
||
|
|
pass
|
||
|
|
else:
|
||
|
|
if self.is_safe_attribute(obj, attribute, value):
|
||
|
|
return value
|
||
|
|
return self.unsafe_undefined(obj, attribute)
|
||
|
|
return self.undefined(obj=obj, name=attribute)
|
||
|
|
|
||
|
|
def unsafe_undefined(self, obj, attribute):
|
||
|
|
"""Return an undefined object for unsafe attributes."""
|
||
|
|
return self.undefined('access to attribute %r of %r '
|
||
|
|
'object is unsafe.' % (
|
||
|
|
attribute,
|
||
|
|
obj.__class__.__name__
|
||
|
|
), name=attribute, obj=obj, exc=SecurityError)
|
||
|
|
|
||
|
|
def format_string(self, s, args, kwargs):
|
||
|
|
"""If a format call is detected, then this is routed through this
|
||
|
|
method so that our safety sandbox can be used for it.
|
||
|
|
"""
|
||
|
|
if isinstance(s, Markup):
|
||
|
|
formatter = SandboxedEscapeFormatter(self, s.escape)
|
||
|
|
else:
|
||
|
|
formatter = SandboxedFormatter(self)
|
||
|
|
kwargs = _MagicFormatMapping(args, kwargs)
|
||
|
|
rv = formatter.vformat(s, args, kwargs)
|
||
|
|
return type(s)(rv)
|
||
|
|
|
||
|
|
def call(__self, __context, __obj, *args, **kwargs):
|
||
|
|
"""Call an object from sandboxed code."""
|
||
|
|
fmt = inspect_format_method(__obj)
|
||
|
|
if fmt is not None:
|
||
|
|
return __self.format_string(fmt, args, kwargs)
|
||
|
|
|
||
|
|
# the double prefixes are to avoid double keyword argument
|
||
|
|
# errors when proxying the call.
|
||
|
|
if not __self.is_safe_callable(__obj):
|
||
|
|
raise SecurityError('%r is not safely callable' % (__obj,))
|
||
|
|
return __context.call(__obj, *args, **kwargs)
|
||
|
|
|
||
|
|
|
||
|
|
class ImmutableSandboxedEnvironment(SandboxedEnvironment):
|
||
|
|
"""Works exactly like the regular `SandboxedEnvironment` but does not
|
||
|
|
permit modifications on the builtin mutable objects `list`, `set`, and
|
||
|
|
`dict` by using the :func:`modifies_known_mutable` function.
|
||
|
|
"""
|
||
|
|
|
||
|
|
def is_safe_attribute(self, obj, attr, value):
|
||
|
|
if not SandboxedEnvironment.is_safe_attribute(self, obj, attr, value):
|
||
|
|
return False
|
||
|
|
return not modifies_known_mutable(obj, attr)
|
||
|
|
|
||
|
|
|
||
|
|
# This really is not a public API apparenlty.
|
||
|
|
try:
|
||
|
|
from _string import formatter_field_name_split
|
||
|
|
except ImportError:
|
||
|
|
def formatter_field_name_split(field_name):
|
||
|
|
return field_name._formatter_field_name_split()
|
||
|
|
|
||
|
|
|
||
|
|
class SandboxedFormatterMixin(object):
|
||
|
|
|
||
|
|
def __init__(self, env):
|
||
|
|
self._env = env
|
||
|
|
|
||
|
|
def get_field(self, field_name, args, kwargs):
|
||
|
|
first, rest = formatter_field_name_split(field_name)
|
||
|
|
obj = self.get_value(first, args, kwargs)
|
||
|
|
for is_attr, i in rest:
|
||
|
|
if is_attr:
|
||
|
|
obj = self._env.getattr(obj, i)
|
||
|
|
else:
|
||
|
|
obj = self._env.getitem(obj, i)
|
||
|
|
return obj, first
|
||
|
|
|
||
|
|
class SandboxedFormatter(SandboxedFormatterMixin, Formatter):
|
||
|
|
|
||
|
|
def __init__(self, env):
|
||
|
|
SandboxedFormatterMixin.__init__(self, env)
|
||
|
|
Formatter.__init__(self)
|
||
|
|
|
||
|
|
class SandboxedEscapeFormatter(SandboxedFormatterMixin, EscapeFormatter):
|
||
|
|
|
||
|
|
def __init__(self, env, escape):
|
||
|
|
SandboxedFormatterMixin.__init__(self, env)
|
||
|
|
EscapeFormatter.__init__(self, escape)
|