diff --git a/namespace.py b/namespace.py index ceae3162..da527a1c 100644 --- a/namespace.py +++ b/namespace.py @@ -572,7 +572,7 @@ def wrap(self, val): -class SafeDict(ObjectProcessor): +class SafeDict(ValueProcessor): """Allows SafeDict objects.""" # TODO: provide a copy function that won't actually copy so that @@ -585,7 +585,7 @@ def check(self, val): -class DictOrSafeDict(ObjectProcessor): +class DictOrSafeDict(ValueProcessor): """Allows SafeDict objects or regular dict objects.""" # TODO: provide a copy function that won't actually copy so that diff --git a/repy.py b/repy.py index a3c0c936..08614906 100755 --- a/repy.py +++ b/repy.py @@ -120,7 +120,6 @@ def get_safe_context(args): #usercontext["createthread"] = emultimer.createthread #usercontext["sleep"] = emultimer.sleep #usercontext["getthreadname"] = emulmisc.getthreadname - usercontext["createvirtualnamespace"] = virtual_namespace.createvirtualnamespace # call the initialize function usercontext['callfunc'] = 'initialize' diff --git a/testsV2/ut_repyv2api_virtualnamespacecontextsafety.py b/testsV2/ut_repyv2api_virtualnamespacecontextsafety.py index 12b835cd..e2b20d80 100644 --- a/testsV2/ut_repyv2api_virtualnamespacecontextsafety.py +++ b/testsV2/ut_repyv2api_virtualnamespacecontextsafety.py @@ -1,21 +1,29 @@ """ -This unit test checks that VirtualNamespace.evaluate() forbids an unsafe context. +Verify that VirtualNamespace.evaluate() forbids an unsafe `context`. + +Specifically, the `context` that a VirtualNamespace object receives +must be a `SafeDict`, or parseable as one. This means that the +context's keys must be of type `str` (which we try to violate in this +test), avoid particular names / prefixes / components, etc. + +Using an unsafe context should raise a `ContextUnsafeError` when +evaluatinig the VirtualNamespace. + +See `safe.py` for what exactly a `SafeDict` is and isn't allowed to +do and to contain. """ #pragma repy -# Small code snippet -code = "log('Bad!')\n" - -# Get a VN -VN = createvirtualnamespace(code, "Bad VN") +# Create a virtual namespace with an empty piece of code and a telling name +vn = createvirtualnamespace("", "Bad VN") -# Create a malicious context -context = {"__metaclass__":str} +# Create a malicious context. (Its key should be `str`, not `int`.) +context = {123: 456} # Try to evaluate this try: - VN.evaluate(context) + vn.evaluate(context) except ContextUnsafeError: pass else: