From c8cdf3170e33282f0fc6185f1fe237098bcd11bd Mon Sep 17 00:00:00 2001 From: Daniel STAN Date: Fri, 27 Feb 2015 12:30:33 +0100 Subject: [PATCH] =?UTF-8?q?DisplayDict:=20=C3=A9vite=20les=20imports=20arb?= =?UTF-8?q?itraires?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- wiki/macro/DisplayDict.py | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/wiki/macro/DisplayDict.py b/wiki/macro/DisplayDict.py index e79b0636..5e1e2ec2 100644 --- a/wiki/macro/DisplayDict.py +++ b/wiki/macro/DisplayDict.py @@ -12,12 +12,29 @@ import sys import os.path import importlib +SECURE_PATHS = ['/usr/scripts'] + def macro_DisplayDict(macro, args): """Suppose que args est de la forme ``path:variable_name``""" # Si on utilise une virgule, MoinMoin foire lamentablement… ("Too many arguments") fichier, variable = args.split(":") # On importe le fichier demandé path = os.path.dirname(fichier) + path = os.path.realpath(path) + + def is_subdir(sec_path): + """Renvoie ``True`` si path est bien un sous-dossier de ``sec_path``""" + if not path.startswith(sec_path): + return False + if len(path) == len(sec_path): + return True + # Si path est strictement plus long, alors on doit s'assure qu'on a + # bien un slash après notre préfixe ``sec_path`` + return path[len(sec_path)] == os.path.sep + + if not any( is_subdir(sec_path) for sec_path in SECURE_PATHS ): + return """[[DisplayDict: forbidden]]""" + if not path in sys.path: sys.path.append(path)