{"action":"created","comment":{"url":"https://api.github.com/repos/matplotlib/matplotlib/pulls/comments/58771013","id":58771013,"diff_hunk":"@@ -746,17 +746,16 @@ def validate_cycler(s):\n             # might come from the internet (future plans), this\n             # could be downright dangerous.\n             # I locked it down by only having the 'cycler()' function\n-            # available. Imports and defs should not\n-            # be possible. However, it is entirely possible that\n-            # a security hole could open up via attributes to the\n-            # function (this is why I decided against allowing the\n-            # Cycler class object just to reduce the number of\n-            # degrees of freedom (but maybe it is safer to use?).\n-            # One possible hole I can think of (in theory) is if\n-            # someone managed to hack the cycler module. But, if\n-            # someone does that, this wouldn't make anything\n-            # worse because we have to import the module anyway.\n-            s = eval(s, {'cycler': cycler})\n+            # available.\n+            # UPDATE: Partly plugging a security hole.\n+            # I really should have read this:\n+            # http://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html\n+            # We should replace this eval with a combo of PyParsing and\n+            # ast.literal_eval()\n+            if '.__' in s.replace(' ', ''):\n+                raise ValueError(\"'%s' seems to have dunder methods. Raising\"","path":"lib/matplotlib/rcsetup.py","position":22,"original_position":22,"commit_id":"b67deca900577f21708c834945c05a0b8cbcb710","original_commit_id":"b67deca900577f21708c834945c05a0b8cbcb710","user":{"login":"QuLogic","id":302469,"avatar_url":"https://avatars.githubusercontent.com/u/302469?v=3","gravatar_id":"","url":"https://api.github.com/users/QuLogic","html_url":"https://github.com/QuLogic","followers_url":"https://api.github.com/users/QuLogic/followers","following_url":"https://api.github.com/users/QuLogic/following{/other_user}","gists_url":"https://api.github.com/users/QuLogic/gists{/gist_id}","starred_url":"https://api.github.com/users/QuLogic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/QuLogic/subscriptions","organizations_url":"https://api.github.com/users/QuLogic/orgs","repos_url":"https://api.github.com/users/QuLogic/repos","events_url":"https://api.github.com/users/QuLogic/events{/privacy}","received_events_url":"https://api.github.com/users/QuLogic/received_events","type":"User","site_admin":false},"body":"This should be put outside the `try` or it will be caught and re-raised with a different message below.","created_at":"2016-04-06T19:57:01Z","updated_at":"2016-04-06T19:57:01Z","html_url":"https://github.com/matplotlib/matplotlib/pull/6274#discussion_r58771013","pull_request_url":"https://api.github.com/repos/matplotlib/matplotlib/pulls/6274","_links":{"self":{"href":"https://api.github.com/repos/matplotlib/matplotlib/pulls/comments/58771013"},"html":{"href":"https://github.com/matplotlib/matplotlib/pull/6274#discussion_r58771013"},"pull_request":{"href":"https://api.github.com/repos/matplotlib/matplotlib/pulls/6274"}}},"pull_request":{"url":"https://api.github.com/repos/matplotlib/matplotlib/pulls/6274","id":65508929,"html_url":"https://github.com/matplotlib/matplotlib/pull/6274","diff_url":"https://github.com/matplotlib/matplotlib/pull/6274.diff","patch_url":"https://github.com/matplotlib/matplotlib/pull/6274.patch","issue_url":"https://api.github.com/repos/matplotlib/matplotlib/issues/6274","number":6274,"state":"open","locked":false,"title":"A feeble attempt to plug a theoretical security hole","user":{"login":"WeatherGod","id":291576,"avatar_url":"https://avatars.githubusercontent.com/u/291576?v=3","gravatar_id":"","url":"https://api.github.com/users/WeatherGod","html_url":"https://github.com/WeatherGod","followers_url":"https://api.github.com/users/WeatherGod/followers","following_url":"https://api.github.com/users/WeatherGod/following{/other_user}","gists_url":"https://api.github.com/users/WeatherGod/gists{/gist_id}","starred_url":"https://api.github.com/users/WeatherGod/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/WeatherGod/subscriptions","organizations_url":"https://api.github.com/users/WeatherGod/orgs","repos_url":"https://api.github.com/users/WeatherGod/repos","events_url":"https://api.github.com/users/WeatherGod/events{/privacy}","received_events_url":"https://api.github.com/users/WeatherGod/received_events","type":"User","site_admin":false},"body":"I introduced a security hole when I implemented the property cycle support last year. I should have read this blog posting: http://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html that would have scared me off of the current implementation.\r\n\r\nWhat this PR does is tries to plug two possible holes. First, it neuters `__builtins__`, which is a good step, but as Ned points out in his post, it is insufficient. Second, I reject any cycler strings that have the substring of `'.__'` in it, as it could be a dunder method access, which is key to the other holes that Ned demonstrates. I don't like that because I can see possible valid uses of that combo of three characters in a property cycler.\r\n\r\n@tacaswell and I have discussed some future directions to fix this permanently that should go into v2.0. Essentially, use PyParsing and `ast.literal_eval()` instead of the unsafe `eval()`. That would take some time, and given that v2.0 is still in the works, I would suggest releasing v1.5.2 as a security fix release.","created_at":"2016-04-06T17:57:21Z","updated_at":"2016-04-06T19:57:01Z","closed_at":null,"merged_at":null,"merge_commit_sha":"340df96b0eb41b12a52dc6f6aa8d7b269c66ea1c","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/matplotlib/matplotlib/pulls/6274/commits","review_comments_url":"https://api.github.com/repos/matplotlib/matplotlib/pulls/6274/comments","review_comment_url":"https://api.github.com/repos/matplotlib/matplotlib/pulls/comments{/number}","comments_url":"https://api.github.com/repos/matplotlib/matplotlib/issues/6274/comments","statuses_url":"https://api.github.com/repos/matplotlib/matplotlib/statuses/b67deca900577f21708c834945c05a0b8cbcb710","head":{"label":"WeatherGod:plug_hole","ref":"plug_hole","sha":"b67deca900577f21708c834945c05a0b8cbcb710","user":{"login":"WeatherGod","id":291576,"avatar_url":"https://avatars.githubusercontent.com/u/291576?v=3","gravatar_id":"","url":"https://api.github.com/users/WeatherGod","html_url":"https://github.com/WeatherGod","followers_url":"https://api.github.com/users/WeatherGod/followers","following_url":"https://api.github.com/users/WeatherGod/following{/other_user}","gists_url":"https://api.github.com/users/WeatherGod/gists{/gist_id}","starred_url":"https://api.github.com/users/WeatherGod/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/WeatherGod/subscriptions","organizations_url":"https://api.github.com/users/WeatherGod/orgs","repos_url":"https://api.github.com/users/WeatherGod/repos","events_url":"https://api.github.com/users/WeatherGod/events{/privacy}","received_events_url":"https://api.github.com/users/WeatherGod/received_events","type":"User","site_admin":false},"repo":{"id":1387436,"name":"matplotlib","full_name":"WeatherGod/matplotlib","owner":{"login":"WeatherGod","id":291576,"avatar_url":"https://avatars.githubusercontent.com/u/291576?v=3","gravatar_id":"","url":"https://api.github.com/users/WeatherGod","html_url":"https://github.com/WeatherGod","followers_url":"https://api.github.com/users/WeatherGod/followers","following_url":"https://api.github.com/users/WeatherGod/following{/other_user}","gists_url":"https://api.github.com/users/WeatherGod/gists{/gist_id}","starred_url":"https://api.github.com/users/WeatherGod/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/WeatherGod/subscriptions","organizations_url":"https://api.github.com/users/WeatherGod/orgs","repos_url":"https://api.github.com/users/WeatherGod/repos","events_url":"https://api.github.com/users/WeatherGod/events{/privacy}","received_events_url":"https://api.github.com/users/WeatherGod/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/WeatherGod/matplotlib","description":"","fork":true,"url":"https://api.github.com/repos/WeatherGod/matplotlib","forks_url":"https://api.github.com/repos/WeatherGod/matplotlib/forks","keys_url":"https://api.github.com/repos/WeatherGod/matplotlib/keys{/key_id}","collaborators_url":"https://api.github.com/repos/WeatherGod/matplotlib/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/WeatherGod/matplotlib/teams","hooks_url":"https://api.github.com/repos/WeatherGod/matplotlib/hooks","issue_events_url":"https://api.github.com/repos/WeatherGod/matplotlib/issues/events{/number}","events_url":"https://api.github.com/repos/WeatherGod/matplotlib/events","assignees_url":"https://api.github.com/repos/WeatherGod/matplotlib/assignees{/user}","branches_url":"https://api.github.com/repos/WeatherGod/matplotlib/branches{/branch}","tags_url":"https://api.github.com/repos/WeatherGod/matplotlib/tags","blobs_url":"https://api.github.com/repos/WeatherGod/matplotlib/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/WeatherGod/matplotlib/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/WeatherGod/matplotlib/git/refs{/sha}","trees_url":"https://api.github.com/repos/WeatherGod/matplotlib/git/trees{/sha}","statuses_url":"https://api.github.com/repos/WeatherGod/matplotlib/statuses/{sha}","languages_url":"https://api.github.com/repos/WeatherGod/matplotlib/languages","stargazers_url":"https://api.github.com/repos/WeatherGod/matplotlib/stargazers","contributors_url":"https://api.github.com/repos/WeatherGod/matplotlib/contributors","subscribers_url":"https://api.github.com/repos/WeatherGod/matplotlib/subscribers","subscription_url":"https://api.github.com/repos/WeatherGod/matplotlib/subscription","commits_url":"https://api.github.com/repos/WeatherGod/matplotlib/commits{/sha}","git_commits_url":"https://api.github.com/repos/WeatherGod/matplotlib/git/commits{/sha}","comments_url":"https://api.github.com/repos/WeatherGod/matplotlib/comments{/number}","issue_comment_url":"https://api.github.com/repos/WeatherGod/matplotlib/issues/comments{/number}","contents_url":"https://api.github.com/repos/WeatherGod/matplotlib/contents/{+path}","compare_url":"https://api.github.com/repos/WeatherGod/matplotlib/compare/{base}...{head}","merges_url":"https://api.github.com/repos/WeatherGod/matplotlib/merges","archive_url":"https://api.github.com/repos/WeatherGod/matplotlib/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/WeatherGod/matplotlib/downloads","issues_url":"https://api.github.com/repos/WeatherGod/matplotlib/issues{/number}","pulls_url":"https://api.github.com/repos/WeatherGod/matplotlib/pulls{/number}","milestones_url":"https://api.github.com/repos/WeatherGod/matplotlib/milestones{/number}","notifications_url":"https://api.github.com/repos/WeatherGod/matplotlib/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/WeatherGod/matplotlib/labels{/name}","releases_url":"https://api.github.com/repos/WeatherGod/matplotlib/releases{/id}","deployments_url":"https://api.github.com/repos/WeatherGod/matplotlib/deployments","created_at":"2011-02-19T21:16:15Z","updated_at":"2015-02-07T22:57:37Z","pushed_at":"2016-04-06T19:48:31Z","git_url":"git://github.com/WeatherGod/matplotlib.git","ssh_url":"git@github.com:WeatherGod/matplotlib.git","clone_url":"https://github.com/WeatherGod/matplotlib.git","svn_url":"https://github.com/WeatherGod/matplotlib","homepage":"","size":228758,"stargazers_count":1,"watchers_count":1,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":1,"mirror_url":null,"open_issues_count":0,"forks":1,"open_issues":0,"watchers":1,"default_branch":"master"}},"base":{"label":"matplotlib:v1.5.x","ref":"v1.5.x","sha":"44e735665b7c25ae38e967f1dd392483dd140da0","user":{"login":"matplotlib","id":215947,"avatar_url":"https://avatars.githubusercontent.com/u/215947?v=3","gravatar_id":"","url":"https://api.github.com/users/matplotlib","html_url":"https://github.com/matplotlib","followers_url":"https://api.github.com/users/matplotlib/followers","following_url":"https://api.github.com/users/matplotlib/following{/other_user}","gists_url":"https://api.github.com/users/matplotlib/gists{/gist_id}","starred_url":"https://api.github.com/users/matplotlib/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/matplotlib/subscriptions","organizations_url":"https://api.github.com/users/matplotlib/orgs","repos_url":"https://api.github.com/users/matplotlib/repos","events_url":"https://api.github.com/users/matplotlib/events{/privacy}","received_events_url":"https://api.github.com/users/matplotlib/received_events","type":"Organization","site_admin":false},"repo":{"id":1385122,"name":"matplotlib","full_name":"matplotlib/matplotlib","owner":{"login":"matplotlib","id":215947,"avatar_url":"https://avatars.githubusercontent.com/u/215947?v=3","gravatar_id":"","url":"https://api.github.com/users/matplotlib","html_url":"https://github.com/matplotlib","followers_url":"https://api.github.com/users/matplotlib/followers","following_url":"https://api.github.com/users/matplotlib/following{/other_user}","gists_url":"https://api.github.com/users/matplotlib/gists{/gist_id}","starred_url":"https://api.github.com/users/matplotlib/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/matplotlib/subscriptions","organizations_url":"https://api.github.com/users/matplotlib/orgs","repos_url":"https://api.github.com/users/matplotlib/repos","events_url":"https://api.github.com/users/matplotlib/events{/privacy}","received_events_url":"https://api.github.com/users/matplotlib/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/matplotlib/matplotlib","description":"matplotlib: plotting with Python","fork":false,"url":"https://api.github.com/repos/matplotlib/matplotlib","forks_url":"https://api.github.com/repos/matplotlib/matplotlib/forks","keys_url":"https://api.github.com/repos/matplotlib/matplotlib/keys{/key_id}","collaborators_url":"https://api.github.com/repos/matplotlib/matplotlib/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/matplotlib/matplotlib/teams","hooks_url":"https://api.github.com/repos/matplotlib/matplotlib/hooks","issue_events_url":"https://api.github.com/repos/matplotlib/matplotlib/issues/events{/number}","events_url":"https://api.github.com/repos/matplotlib/matplotlib/events","assignees_url":"https://api.github.com/repos/matplotlib/matplotlib/assignees{/user}","branches_url":"https://api.github.com/repos/matplotlib/matplotlib/branches{/branch}","tags_url":"https://api.github.com/repos/matplotlib/matplotlib/tags","blobs_url":"https://api.github.com/repos/matplotlib/matplotlib/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/matplotlib/matplotlib/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/matplotlib/matplotlib/git/refs{/sha}","trees_url":"https://api.github.com/repos/matplotlib/matplotlib/git/trees{/sha}","statuses_url":"https://api.github.com/repos/matplotlib/matplotlib/statuses/{sha}","languages_url":"https://api.github.com/repos/matplotlib/matplotlib/languages","stargazers_url":"https://api.github.com/repos/matplotlib/matplotlib/stargazers","contributors_url":"https://api.github.com/repos/matplotlib/matplotlib/contributors","subscribers_url":"https://api.github.com/repos/matplotlib/matplotlib/subscribers","subscription_url":"https://api.github.com/repos/matplotlib/matplotlib/subscription","commits_url":"https://api.github.com/repos/matplotlib/matplotlib/commits{/sha}","git_commits_url":"https://api.github.com/repos/matplotlib/matplotlib/git/commits{/sha}","comments_url":"https://api.github.com/repos/matplotlib/matplotlib/comments{/number}","issue_comment_url":"https://api.github.com/repos/matplotlib/matplotlib/issues/comments{/number}","contents_url":"https://api.github.com/repos/matplotlib/matplotlib/contents/{+path}","compare_url":"https://api.github.com/repos/matplotlib/matplotlib/compare/{base}...{head}","merges_url":"https://api.github.com/repos/matplotlib/matplotlib/merges","archive_url":"https://api.github.com/repos/matplotlib/matplotlib/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/matplotlib/matplotlib/downloads","issues_url":"https://api.github.com/repos/matplotlib/matplotlib/issues{/number}","pulls_url":"https://api.github.com/repos/matplotlib/matplotlib/pulls{/number}","milestones_url":"https://api.github.com/repos/matplotlib/matplotlib/milestones{/number}","notifications_url":"https://api.github.com/repos/matplotlib/matplotlib/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/matplotlib/matplotlib/labels{/name}","releases_url":"https://api.github.com/repos/matplotlib/matplotlib/releases{/id}","deployments_url":"https://api.github.com/repos/matplotlib/matplotlib/deployments","created_at":"2011-02-19T03:17:12Z","updated_at":"2016-04-06T08:52:45Z","pushed_at":"2016-04-06T19:56:11Z","git_url":"git://github.com/matplotlib/matplotlib.git","ssh_url":"git@github.com:matplotlib/matplotlib.git","clone_url":"https://github.com/matplotlib/matplotlib.git","svn_url":"https://github.com/matplotlib/matplotlib","homepage":"http://matplotlib.org/","size":391222,"stargazers_count":3469,"watchers_count":3469,"language":"Python","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":1768,"mirror_url":null,"open_issues_count":859,"forks":1768,"open_issues":859,"watchers":3469,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/matplotlib/matplotlib/pulls/6274"},"html":{"href":"https://github.com/matplotlib/matplotlib/pull/6274"},"issue":{"href":"https://api.github.com/repos/matplotlib/matplotlib/issues/6274"},"comments":{"href":"https://api.github.com/repos/matplotlib/matplotlib/issues/6274/comments"},"review_comments":{"href":"https://api.github.com/repos/matplotlib/matplotlib/pulls/6274/comments"},"review_comment":{"href":"https://api.github.com/repos/matplotlib/matplotlib/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/matplotlib/matplotlib/pulls/6274/commits"},"statuses":{"href":"https://api.github.com/repos/matplotlib/matplotlib/statuses/b67deca900577f21708c834945c05a0b8cbcb710"}}}}