Lambda application causes crash instead of `FeatureNotAvailable` about simpleeval HOT 4 CLOSED

Thanks! That's great!

I've blacklisted the 'mro' method for now (man, I'm learning a lot about Python through this project), and also added in a proper exception for the lambda crash.

The current git HEAD does actually have list comprehension support added to the EvalWithCompoundTypes class, but with an explicit limit on how many recursions it will do.

Could you poke around with that and see if you can find a way to by-pass it, and if so, raise a new issue?

from simpleeval.

Huh - now that's a weird one.

Good catch.

Please continue digging for problems!

from simpleeval.

I found one more potential vulnerability – non-whitelisted classes can be accessed through SomeClass.mro(), you might want to block that. Other than that, blacklisting lambdas, __dunder__ methods/attributes and list comprehensions¹ seems very effective, I couldn't come up with any hacks without those.

¹ list comprehensions can be used to bind names: [... for x in (foo(),)] ≈ let x = foo() in .... One could use that to create a self-referencing object and call something on it to get a crash via infinite recursion. As an example, this expression yields a list that contains itself: [(x.append(x), x)[-1] for x in ([],)][0] ≈ let x = [] in (x.append(x); x)

from simpleeval.

Okay, I'll check it out! (pun partially intended)

from simpleeval.