{"action":"created","issue":{"url":"https://api.github.com/repos/PiotrDabkowski/Js2Py/issues/45","repository_url":"https://api.github.com/repos/PiotrDabkowski/Js2Py","labels_url":"https://api.github.com/repos/PiotrDabkowski/Js2Py/issues/45/labels{/name}","comments_url":"https://api.github.com/repos/PiotrDabkowski/Js2Py/issues/45/comments","events_url":"https://api.github.com/repos/PiotrDabkowski/Js2Py/issues/45/events","html_url":"https://github.com/PiotrDabkowski/Js2Py/issues/45","id":158477531,"number":45,"title":"Disable pyimport by default, for security","user":{"login":"rbcarson","id":46059,"avatar_url":"https://avatars.githubusercontent.com/u/46059?v=3","gravatar_id":"","url":"https://api.github.com/users/rbcarson","html_url":"https://github.com/rbcarson","followers_url":"https://api.github.com/users/rbcarson/followers","following_url":"https://api.github.com/users/rbcarson/following{/other_user}","gists_url":"https://api.github.com/users/rbcarson/gists{/gist_id}","starred_url":"https://api.github.com/users/rbcarson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rbcarson/subscriptions","organizations_url":"https://api.github.com/users/rbcarson/orgs","repos_url":"https://api.github.com/users/rbcarson/repos","events_url":"https://api.github.com/users/rbcarson/events{/privacy}","received_events_url":"https://api.github.com/users/rbcarson/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-06-04T00:31:33Z","updated_at":"2016-06-04T19:26:22Z","closed_at":null,"body":"I'm exploring the use of this library for a project I'm working on, and it looks amazing. I am interested in using this library to parse and execute functions from potentially untrusted JavaScript files, so I am concerned by the availability of the `pyimport` keyword. Is it possible to add an option to enable/disable this feature, *and* have it disabled by default?\r\n\r\nDoing this would make the default behaviour of Js2Py much safer and similar to standard JavaScript."},"comment":{"url":"https://api.github.com/repos/PiotrDabkowski/Js2Py/issues/comments/223773519","html_url":"https://github.com/PiotrDabkowski/Js2Py/issues/45#issuecomment-223773519","issue_url":"https://api.github.com/repos/PiotrDabkowski/Js2Py/issues/45","id":223773519,"user":{"login":"Lexcon","id":4091643,"avatar_url":"https://avatars.githubusercontent.com/u/4091643?v=3","gravatar_id":"","url":"https://api.github.com/users/Lexcon","html_url":"https://github.com/Lexcon","followers_url":"https://api.github.com/users/Lexcon/followers","following_url":"https://api.github.com/users/Lexcon/following{/other_user}","gists_url":"https://api.github.com/users/Lexcon/gists{/gist_id}","starred_url":"https://api.github.com/users/Lexcon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Lexcon/subscriptions","organizations_url":"https://api.github.com/users/Lexcon/orgs","repos_url":"https://api.github.com/users/Lexcon/repos","events_url":"https://api.github.com/users/Lexcon/events{/privacy}","received_events_url":"https://api.github.com/users/Lexcon/received_events","type":"User","site_admin":false},"created_at":"2016-06-04T19:26:21Z","updated_at":"2016-06-04T19:26:21Z","body":"I'm not sure if disabling pyimport would be sufficient. Running \nuntrusted source using this library is a ballgame that would require \nsevere thinking rather than a quick fix. Potential issues are which \nobjects are directly exposed in the runnable space, and which one more \nindirectly. The usual suspects are:\n\nexec\neval\ntype\n\n\nhttp://programmers.stackexchange.com/questions/191623/best-practices-for-execution-of-untrusted-code\n\nRead the post of Martijn Pieters.\n\nRobert\n\nOn 6/4/2016 2:31 AM, Carson Lam wrote:\n>\n> I'm exploring the use of this library for a project I'm working on, \n> and it looks amazing. I am interested in using this library to parse \n> and execute functions from potentially untrusted JavaScript files, so \n> I am concerned by the availability of the |pyimport| keyword. Is it \n> possible to add an option to enable/disable this feature, /and/ have \n> it disabled by default?\n>\n> Doing this would make the default behaviour of Js2Py much safer and \n> similar to standard JavaScript.\n>\n> —\n> You are receiving this because you are subscribed to this thread.\n> Reply to this email directly, view it on GitHub \n> <https://github.com/PiotrDabkowski/Js2Py/issues/45>, or mute the \n> thread \n> <https://github.com/notifications/unsubscribe/AD5u-33kt0KYJUGfxnm3HevFcflyBnV6ks5qIMdmgaJpZM4IuAdh>.\n>\n\n"}}
{"actor":{"display_login":"Lexcon"}}