<s> """<STR_LIT>""" <EOL> import types <EOL> import operator <EOL> from jinja2 . environment import Environment <EOL> from jinja2 . exceptions import SecurityError <EOL> from jinja2 . _compat import string_types , PY2 <EOL> MAX_RANGE = <NUM_LIT> <EOL> if PY2 : <EOL> UNSAFE_FUNCTION_ATTRIBUTES = set ( [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , <EOL> '<STR_LIT>' , '<STR_LIT>' ] ) <EOL> else : <EOL> UNSAFE_FUNCTION_ATTRIBUTES = set ( ) <EOL> UNSAFE_METHOD_ATTRIBUTES = set ( [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' ] ) <EOL> UNSAFE_GENERATOR_ATTRIBUTES = set ( [ '<STR_LIT>' , '<STR_LIT>' ] ) <EOL> import warnings <EOL> warnings . filterwarnings ( '<STR_LIT:ignore>' , '<STR_LIT>' , DeprecationWarning , <EOL> module = '<STR_LIT>' ) <EOL> from collections import deque <EOL> _mutable_set_types = ( set , ) <EOL> _mutable_mapping_types = ( dict , ) <EOL> _mutable_sequence_types = ( list , ) <EOL> try : <EOL> from UserDict import UserDict , DictMixin <EOL> from UserList import UserList <EOL> _mutable_mapping_types += ( UserDict , DictMixin ) <EOL> _mutable_set_types += ( UserList , ) <EOL> except ImportError : <EOL> pass <EOL> try : <EOL> from sets import Set <EOL> _mutable_set_types += ( Set , ) <EOL> except ImportError : <EOL> pass <EOL> try : <EOL> from collections import MutableSet , MutableMapping , MutableSequence <EOL> _mutable_set_types += ( MutableSet , ) <EOL> _mutable_mapping_types += ( MutableMapping , ) <EOL> _mutable_sequence_types += ( MutableSequence , ) <EOL> except ImportError : <EOL> pass <EOL> _mutable_spec = ( <EOL> ( _mutable_set_types , frozenset ( [ <EOL> '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , <EOL> '<STR_LIT>' , '<STR_LIT>' <EOL> ] ) ) , <EOL> ( _mutable_mapping_types , frozenset ( [ <EOL> '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' <EOL> ] ) ) , <EOL> ( _mutable_sequence_types , frozenset ( [ <EOL> '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' <EOL> ] ) ) , <EOL> ( deque , frozenset ( [ <EOL> '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , <EOL> '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' <EOL> ] ) ) <EOL> ) <EOL> def safe_range ( * args ) : <EOL> """<STR_LIT>""" <EOL> rng = range ( * args ) <EOL> if len ( rng ) > MAX_RANGE : <EOL> raise OverflowError ( '<STR_LIT>' % <EOL> MAX_RANGE ) <EOL> return rng <EOL> def unsafe ( f ) : <EOL> """<STR_LIT>""" <EOL> f . unsafe_callable = True <EOL> return f <EOL> def is_internal_attribute ( obj , attr ) : <EOL> """<STR_LIT>""" <EOL> if isinstance ( obj , types . FunctionType ) : <EOL> if attr in UNSAFE_FUNCTION_ATTRIBUTES : <EOL> return True <EOL> elif isinstance ( obj , types . MethodType ) : <EOL> if attr in UNSAFE_FUNCTION_ATTRIBUTES or attr in UNSAFE_METHOD_ATTRIBUTES : <EOL> return True <EOL> elif isinstance ( obj , type ) : <EOL> if attr == '<STR_LIT>' : <EOL> return True <EOL> elif isinstance ( obj , ( types . CodeType , types . TracebackType , types . FrameType ) ) : <EOL> return True <EOL> elif isinstance ( obj , types . GeneratorType ) : <EOL> if attr in UNSAFE_GENERATOR_ATTRIBUTES : <EOL> return True <EOL> return attr . startswith ( '<STR_LIT>' ) <EOL> def modifies_known_mutable ( obj , attr ) : <EOL> """<STR_LIT>""" <EOL> for typespec , unsafe in _mutable_spec : <EOL> if isinstance ( obj , typespec ) : <EOL> return attr in unsafe <EOL> return False <EOL> class SandboxedEnvironment ( Environment ) : <EOL> """<STR_LIT>""" <EOL> sandboxed = True <EOL> default_binop_table = { <EOL> '<STR_LIT:+>' : operator . add , <EOL> '<STR_LIT:->' : operator . sub , <EOL> '<STR_LIT:*>' : operator . mul , <EOL> '<STR_LIT:/>' : operator . truediv , <EOL> '<STR_LIT>' : operator . floordiv , <EOL> '<STR_LIT>' : operator . pow , <EOL> '<STR_LIT:%>' : operator . mod <EOL> } <EOL> default_unop_table = { <EOL> '<STR_LIT:+>' : operator . pos , <EOL> '<STR_LIT:->' : operator . neg <EOL> } <EOL> intercepted_binops = frozenset ( ) <EOL> intercepted_unops = frozenset ( ) <EOL> def intercept_unop ( self , operator ) : <EOL> """<STR_LIT>""" <EOL> return False <EOL> def __init__ ( self , * args , ** kwargs ) : <EOL> Environment . __init__ ( self , * args , ** kwargs ) <EOL> self . globals [ '<STR_LIT>' ] = safe_range <EOL> self . binop_table = self . default_binop_table . copy ( ) <EOL> self . unop_table = self . default_unop_table . copy ( ) <EOL> def is_safe_attribute ( self , obj , attr , value ) : <EOL> """<STR_LIT>""" <EOL> return not ( attr . startswith ( '<STR_LIT:_>' ) or is_internal_attribute ( obj , attr ) ) <EOL> def is_safe_callable ( self , obj ) : <EOL> """<STR_LIT>""" <EOL> return not ( getattr ( obj , '<STR_LIT>' , False ) or <EOL> getattr ( obj , '<STR_LIT>' , False ) ) <EOL> def call_binop ( self , context , operator , left , right ) : <EOL> """<STR_LIT>""" <EOL> return self . binop_table [ operator ] ( left , right ) <EOL> def call_unop ( self , context , operator , arg ) : <EOL> """<STR_LIT>""" <EOL> return self . unop_table [ operator ] ( arg ) <EOL> def getitem ( self , obj , argument ) : <EOL> """<STR_LIT>""" <EOL> try : <EOL> return obj [ argument ] <EOL> except ( TypeError , LookupError ) : <EOL> if isinstance ( argument , string_types ) : <EOL> try : <EOL> attr = str ( argument ) <EOL> except Exception : <EOL> pass <EOL> else : <EOL> try : <EOL> value = getattr ( obj , attr ) <EOL> except AttributeError : <EOL> pass <EOL> else : <EOL> if self . is_safe_attribute ( obj , argument , value ) : <EOL> return value <EOL> return self . unsafe_undefined ( obj , argument ) <EOL> return self . undefined ( obj = obj , name = argument ) <EOL> def getattr ( self , obj , attribute ) : <EOL> """<STR_LIT>""" <EOL> try : <EOL> value = getattr ( obj , attribute ) <EOL> except AttributeError : <EOL> try : <EOL> return obj [ attribute ] <EOL> except ( TypeError , LookupError ) : <EOL> pass <EOL> else : <EOL> if self . is_safe_attribute ( obj , attribute , value ) : <EOL> return value <EOL> return self . unsafe_undefined ( obj , attribute ) <EOL> return self . undefined ( obj = obj , name = attribute ) <EOL> def unsafe_undefined ( self , obj , attribute ) : <EOL> """<STR_LIT>""" <EOL> return self . undefined ( '<STR_LIT>' <EOL> '<STR_LIT>' % ( <EOL> attribute , <EOL> obj . __class__ . __name__ <EOL> ) , name = attribute , obj = obj , exc = SecurityError ) <EOL> def call ( __self , __context , __obj , * args , ** kwargs ) : <EOL> """<STR_LIT>""" <EOL> if not __self . is_safe_callable ( __obj ) : <EOL> raise SecurityError ( '<STR_LIT>' % ( __obj , ) ) <EOL> return __context . call ( __obj , * args , ** kwargs ) <EOL> class ImmutableSandboxedEnvironment ( SandboxedEnvironment ) : <EOL> """<STR_LIT>""" <EOL> def is_safe_attribute ( self , obj , attr , value ) : <EOL> if not SandboxedEnvironment . is_safe_attribute ( self , obj , attr , value ) : <EOL> return False <EOL> return not modifies_known_mutable ( obj , attr ) </s>
