U gE@s>dZddlZddlZzddlmZWnddlmZYnXddlmZddlm Z ddl m Z ddl m Z mZddlmZdd lmZdd lmZd Zered d dddgZneZedddgZeddgZeddgZeddgZddlZejddeddzddlmZWn"e k r6ddlmZYnXefZ!e"fZ#e$fZ%z6ddl&m&Z&m'Z'dd l(m(Z(e#e&e'f7Z#e!e(f7Z!Wne k rYnXzdd!l)m*Z*e!e*f7Z!Wne k rYnXzdd"lm+Z+m,Z,m-Z-Wn dd"lm+Z+m,Z,m-Z-YnXe!e+f7Z!e#e,f7Z#e%e-f7Z%e!e.d#d$d%d&d'd(d)d*gfe#e.d$d'd+d,d*gfe%e.d-d.d/d0d1d(gfee.d-d2d$d1d3d'd4d(d5g ffZ/Gd6d7d7eZ0d8d9Z1d:d;Z2dd?Z4Gd@dAdAe Z5GdBdCdCe5Z6zddDl7m8Z8Wne k rdEdFZ8YnXGdGdHdHe9Z:GdIdJdJe:eZ;GdKdLdLe:eZ>> from jinja2.sandbox import is_internal_attribute >>> is_internal_attribute(str, "mro") True >>> is_internal_attribute(str, "upper") False Tmro CoroutineTypeAsyncGeneratorType__) isinstancetypes FunctionTypeUNSAFE_FUNCTION_ATTRIBUTES MethodTypeUNSAFE_METHOD_ATTRIBUTEStypeCodeType TracebackType FrameType GeneratorTypeUNSAFE_GENERATOR_ATTRIBUTEShasattrrSUNSAFE_COROUTINE_ATTRIBUTESrT!UNSAFE_ASYNC_GENERATOR_ATTRIBUTES startswith)objattrr6r6r7is_internal_attributes.    rhcCs(tD]\}}t||r||kSqdS)aThis function checks if an attribute on a builtin mutable object (list, dict, set or deque) would modify it if called. It also supports the "user"-versions of the objects (`sets.Set`, `UserDict.*` etc.) and with Python 2.6 onwards the abstract base classes `MutableSet`, `MutableMapping`, and `MutableSequence`. >>> modifies_known_mutable({}, "clear") True >>> modifies_known_mutable({}, "keys") False >>> modifies_known_mutable([], "append") True >>> modifies_known_mutable([], "index") False If called with an unsupported object (such as unicode) `False` is returned. >>> modifies_known_mutable("foo", "upper") False F) _mutable_specrV)rfrgZtypespecrQr6r6r7modifies_known_mutables  rjc@seZdZdZdZejejejej ej ej ej dZ ejejdZeZeZddZddZd d Zd d Zd dZddZddZddZddZddZddZdS)SandboxedEnvironmentaThe sandboxed environment. It works like the regular environment but tells the compiler to generate sandboxed code. Additionally subclasses of this environment may override the methods that tell the runtime what attributes or functions are safe to access. If the template tries to access insecure code a :exc:`SecurityError` is raised. However also other exceptions may occur during the rendering so the caller has to ensure that all exceptions are caught. T)+-*/z//z**%)rlrmcCsdS)aCalled during template compilation with the name of a unary operator to check if it should be intercepted at runtime. If this method returns `True`, :meth:`call_unop` is excuted for this unary operator. The default implementation of :meth:`call_unop` will use the :attr:`unop_table` dictionary to perform the operator with the same logic as the builtin one. The following unary operators are interceptable: ``+`` and ``-`` Intercepted calls are always slower than the native operator call, so make sure only to intercept the ones you are interested in. .. versionadded:: 2.6 Fr6)r3operatorr6r6r7intercept_unop.sz#SandboxedEnvironment.intercept_unopcOs8tj|f||t|jd<|j|_|j|_dS)NrJ) rr8rNglobalsdefault_binop_tablecopy binop_tabledefault_unop_table unop_tabler2r6r6r7r8@s  zSandboxedEnvironment.__init__cCs|dpt|| S)aYThe sandboxed environment will call this method to check if the attribute of an object is safe to access. Per default all attributes starting with an underscore are considered private as well as the special attributes of internal python objects as returned by the :func:`is_internal_attribute` function. _)rerhr3rfrgvaluer6r6r7is_safe_attributeFsz&SandboxedEnvironment.is_safe_attributecCst|ddpt|dd S)aCheck if an object is safely callable. Per default a function is considered safe unless the `unsafe_callable` attribute exists and is True. Override this method to alter the behavior, but this won't affect the `unsafe` decorator from this module. rOFZ alters_data)getattr)r3rfr6r6r7is_safe_callableOs  z%SandboxedEnvironment.is_safe_callablecCs|j|||S)zFor intercepted binary operator calls (:meth:`intercepted_binops`) this function is executed instead of the builtin operator. This can be used to fine tune the behavior of certain operators. .. versionadded:: 2.6 )rv)r3contextrqleftrightr6r6r7 call_binopXszSandboxedEnvironment.call_binopcCs|j||S)zFor intercepted unary operator calls (:meth:`intercepted_unops`) this function is executed instead of the builtin operator. This can be used to fine tune the behavior of certain operators. .. versionadded:: 2.6 )rx)r3rrqargr6r6r7 call_unopaszSandboxedEnvironment.call_unopc Csz ||WSttfk rt|trz t|}Wntk rHYnfXzt||}Wntk rlYnBX||}|dk r|YS| |||r|YS| ||YSYnX|j ||dS)z(Subscribe an object from sandboxed code.Nrfname) TypeErrorr;rVrr< Exceptionr}AttributeErrorwrap_str_formatr|unsafe_undefined undefined)r3rfZargumentrgr{fmtr6r6r7getitemjs&    zSandboxedEnvironment.getitemc Cszt||}Wn<tk rJz||WYSttfk rDYnXYn6X||}|dk rb|S||||rt|S|||S|j||dS)zSubscribe an object from sandboxed code and prefer the attribute. The attribute passed *must* be a bytestring. Nr)r}rrr;rr|rr)r3rf attributer{rr6r6r7r}s   zSandboxedEnvironment.getattrcCs|jd||jjf||tdS)z1Return an undefined object for unsafe attributes.z.access to attribute %r of %r object is unsafe.)rrfexc)r __class__rFr)r3rfrr6r6r7rsz%SandboxedEnvironment.unsafe_undefinedcst|tjtjfr|jdkr dS|jtts>tts>dSt|jdkttrht |j }nt |}|j fdd}t ||S)aIf the given value is a ``str.format`` or ``str.format_map`` method, return a new function than handles sandboxing. This is done at access rather than in :meth:`call`, so that calls made without ``call`` are also sandboxed. )format format_mapNrcsRr8|rtdt|dkr,tdt||d}d}t||}||S)Nz'format_map() takes no keyword argumentsr:z2format_map() takes exactly one argument (%d given)r)rrDr.)r4r5Zf_selfZ is_format_mapZstr_typevformatr6r7wrappers  z5SandboxedEnvironment.wrap_str_format..wrapper)rVrWrZBuiltinMethodTyperF__self__r<rr\SandboxedEscapeFormatterescapeSandboxedFormatterrr)r3r{Z formatterrr6rr7rs$   z$SandboxedEnvironment.wrap_str_formatcOs*||std|f|j|f||S)z#Call an object from sandboxed code.z%r is not safely callable)r~rcall)Z_SandboxedEnvironment__selfZ_SandboxedEnvironment__contextZ_SandboxedEnvironment__objr4r5r6r6r7rs zSandboxedEnvironment.callN)rFrGrHrIZ sandboxedrqrsubmultruedivfloordivpowmodrtposnegrw frozensetZintercepted_binopsZintercepted_unopsrrr8r|r~rrrr}rrrr6r6r6r7rks4     ,rkc@seZdZdZddZdS)ImmutableSandboxedEnvironmentzWorks exactly like the regular `SandboxedEnvironment` but does not permit modifications on the builtin mutable objects `list`, `set`, and `dict` by using the :func:`modifies_known_mutable` function. cCs t||||sdSt|| S)NF)rkr|rjrzr6r6r7r|sz/ImmutableSandboxedEnvironment.is_safe_attributeN)rFrGrHrIr|r6r6r6r7rsr)formatter_field_name_splitcCs|Sr@)Z_formatter_field_name_split) field_namer6r6r7rsrc@seZdZddZddZdS)SandboxedFormatterMixincCs ||_dSr@)_envr3envr6r6r7r8sz SandboxedFormatterMixin.__init__c CsRt|\}}||||}|D]*\}}|r:|j||}q|j||}q||fSr@)rZ get_valuerr}r) r3rr4r5firstrestrfZis_attrir6r6r7 get_fields  z!SandboxedFormatterMixin.get_fieldN)rFrGrHr8rr6r6r6r7rsrc@seZdZddZdS)rcCst||t|dSr@)rr8r rr6r6r7r8s zSandboxedFormatter.__init__NrFrGrHr8r6r6r6r7rsrc@seZdZddZdS)rcCst||t||dSr@)rr8r )r3rrr6r6r7r8s z!SandboxedEscapeFormatter.__init__Nrr6r6r6r7rsr)=rIrWrq collectionsrZcollections.abc functoolsrZjinja2.environmentrZjinja2.exceptionsrZjinja2._compatrrZ jinja2.utilsrZ markupsafer stringr rKsetrYr[rarcrdwarningsfilterwarningsDeprecationWarningr ImportErrorZ_mutable_set_typesdictZ_mutable_mapping_typeslistZ_mutable_sequence_typesrrrZsetsrrrrrrir.rNrQrhrjrkrZ_stringrobjectrrrr6r6r6r7s                   $g