WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-08-26 01:22:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

- Fix python examples/calc.py for eval, reported by X41 D-Sec.

Browse Source
This commit is contained in:
W.C.A. Wijngaards
2019-11-20 15:07:09 +01:00
parent da4d6ffee3
commit 8833d44d01
2 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pythonmod/examples/calc.py
+6 -2
View File
@@ -45,9 +45,13 @@ def operate(id, event, qstate, qdata):
if (event == MODULE_EVENT_NEW) or (event == MODULE_EVENT_PASS):
if qstate.qinfo.qname_str.endswith("._calc_.cz."):
if qstate.qinfo.qname_str.endswith("._calc_.cz.") and not ("__" in qstate.qinfo.qname_str):
try:
res = eval(''.join(qstate.qinfo.qname_list[0:-3]))
# the second and third argument to eval attempt to restrict
# functions and variables available to stop code execution
# but it may not be safe either. This is why __ substrings
# are excluded from evaluation.
res = eval(''.join(qstate.qinfo.qname_list[0:-3]),{"__builtins__":None},{})
except:
res = "exception"