4848import pg_encoder
4949
5050
51- # TODO: not threadsafe:
52-
5351# upper-bound on the number of executed lines, in order to guard against
5452# infinite loops
5553#MAX_EXECUTED_LINES = 300
@@ -91,6 +89,7 @@ def write(self, s):
9189
9290# These could lead to XSS or other code injection attacks, so be careful:
9391# these are now deprecated as of 2016-06-28
92+ '''
9493__html__ = None
9594def setHTML(htmlStr):
9695 global __html__
@@ -105,6 +104,7 @@ def setCSS(cssStr):
105104def setJS(jsStr):
106105 global __js__
107106 __js__ = jsStr
107+ '''
108108
109109
110110# ugh, I can't figure out why in Python 2, __builtins__ seems to
@@ -189,11 +189,12 @@ def __restricted_import__(*args):
189189 if args [0 ] in all_allowed_imports :
190190 imported_mod = BUILTIN_IMPORT (* args )
191191
192- if args [0 ] in CUSTOM_MODULE_IMPORTS :
193- # add special magical functions to custom imported modules
194- setattr (imported_mod , 'setHTML' , setHTML )
195- setattr (imported_mod , 'setCSS' , setCSS )
196- setattr (imported_mod , 'setJS' , setJS )
192+ # these are now deprecated as of 2016-06-28
193+ #if args[0] in CUSTOM_MODULE_IMPORTS:
194+ # # add special magical functions to custom imported modules
195+ # setattr(imported_mod, 'setHTML', setHTML)
196+ # setattr(imported_mod, 'setCSS', setCSS)
197+ # setattr(imported_mod, 'setJS', setJS)
197198
198199 # somewhat weak protection against imported modules that contain one
199200 # of these troublesome builtins. again, NOTHING is foolproof ...
@@ -1265,13 +1266,13 @@ def create_encoded_stack_entry(cur_frame):
12651266
12661267 # TODO: refactor into a non-global
12671268 # these are now deprecated as of 2016-06-28
1268- global __html__ , __css__ , __js__
1269- if __html__ :
1270- trace_entry ['html_output' ] = __html__
1271- if __css__ :
1272- trace_entry ['css_output' ] = __css__
1273- if __js__ :
1274- trace_entry ['js_output' ] = __js__
1269+ # global __html__, __css__, __js__
1270+ # if __html__:
1271+ # trace_entry['html_output'] = __html__
1272+ # if __css__:
1273+ # trace_entry['css_output'] = __css__
1274+ # if __js__:
1275+ # trace_entry['js_output'] = __js__
12751276
12761277 # if there's an exception, then record its info:
12771278 if event_type == 'exception' :
@@ -1398,13 +1399,6 @@ def _runscript(self, script_str):
13981399
13991400 user_builtins ['mouse_input' ] = mouse_input_wrapper
14001401
1401- # TODO: we can disable these imports here, but a crafty user can
1402- # always get a hold of them by importing one of the external
1403- # modules, so there's no point in trying security by obscurity
1404- user_builtins ['setHTML' ] = setHTML
1405- user_builtins ['setCSS' ] = setCSS
1406- user_builtins ['setJS' ] = setJS
1407-
14081402 if self .separate_stdout_by_module :
14091403 self .stdout_by_module ["__main__" ] = StringIO .StringIO ()
14101404 if self .custom_modules :
@@ -1602,8 +1596,9 @@ def exec_script_str(script_str, raw_input_lst_json, options_json, finalizer_func
16021596 # TODO: if we want to support unicode, remove str() cast
16031597 input_string_queue = [str (e ) for e in json .loads (raw_input_lst_json )]
16041598
1605- global __html__ , __css__ , __js__
1606- __html__ , __css__ , __js__ = None , None , None
1599+ # these are now deprecated as of 2016-06-28
1600+ #global __html__, __css__, __js__
1601+ #__html__, __css__, __js__ = None, None, None
16071602
16081603 try :
16091604 logger ._runscript (script_str )
@@ -1633,28 +1628,13 @@ def exec_script_str_local(script_str, raw_input_lst_json, cumulative_mode, heap_
16331628 # TODO: if we want to support unicode, remove str() cast
16341629 input_string_queue = [str (e ) for e in json .loads (raw_input_lst_json )]
16351630
1636- global __html__ , __css__ , __js__
1637- __html__ , __css__ , __js__ = None , None , None
1631+ # these are now deprecated as of 2016-06-28
1632+ #global __html__, __css__, __js__
1633+ #__html__, __css__, __js__ = None, None, None
16381634
16391635 try :
16401636 logger ._runscript (script_str )
16411637 except bdb .BdbQuit :
16421638 pass
16431639 finally :
16441640 return logger .finalize ()
1645-
1646-
1647- # deprecated?!?
1648- def exec_str_with_user_ns (script_str , user_ns , finalizer_func ):
1649- logger = PGLogger (False , False , False , finalizer_func , disable_security_checks = True )
1650-
1651- global __html__ , __css__ , __js__
1652- __html__ , __css__ , __js__ = None , None , None
1653-
1654- try :
1655- logger ._runscript (script_str , user_ns )
1656- except bdb .BdbQuit :
1657- pass
1658- finally :
1659- return logger .finalize ()
1660-
0 commit comments