]jB R d Z ddlZddlZddlZddlmZ ddlmZ ddlm Z ddlm
Z
ddl m Z dd l m
Z
dd
l mZ dd l mZ dd lmZ dd
lmZ dZe
rh dZn
e Zh dZddhZddhZddhZ ej dde e efZ e fZ e!fZ" ddl#m#Z#m$Z$ ddl%m%Z% e e#e$fz
Z e e%fz
Z n # e&$ r Y nw xY w dd l'm(Z( e e(fz
Z n # e&$ r Y nw xY we e j) fz
Z e e j* fz
Z e"e j+ fz
Z"e e,g d fe e,g d fe" e,g d fe e,g d ffZ- G d! d"e j. Z/d# Z0d$ Z1d% Z2d& Z3d' Z4 G d( d)e Z5 G d* d+e5 Z6 dd,l7m8Z8 n# e&$ r d- Z8Y nw xY w G d. d/e9 Z: G d0 d1e:e Z; G d2 d3e:e Z<dS )4zA sandbox layer that ensures unsafe operations cannot be performed.
Useful when the template itself comes from an untrusted source.
N)deque) Formatter)EscapeFormatter)Markup )abc)PY2)
range_type) string_types) Environment)
SecurityErrori > func_code func_dict func_closure func_globals
func_defaults> im_funcim_selfim_classgi_framegi_codecr_framecr_codeag_codeag_frameignorezthe sets module)module)UserDict DictMixin)UserList)Set)addcleardifference_updatediscardpopremovesymmetric_difference_updateupdate)r# r& popitem
setdefaultr) )appendreverseinsertsortextendr' ) r,
appendleftr# r0
extendleftr& popleftr' rotatec * e Zd ZdZd Zd Zd Zd ZdS )_MagicFormatMappingzThis class implements a dummy wrapper to fix a bug in the Python
standard library for string formatting.
See https://bugs.python.org/issue13598 for information about why
this is necessary.
c 0 || _ || _ d| _ d S )Nr )_args_kwargs _last_indexselfargskwargss n/builddir/build/BUILD/imunify360-venv-2.6.3/opt/imunify360/venv/lib/python3.11/site-packages/jinja2/sandbox.py__init__z _MagicFormatMapping.__init__ s
c |dk rD| j }| xj dz
c_ | j | S # t $ r Y nw xY wt | }| j | S )N r )r: r8 LookupErrorstrr9 )r< keyidxs r? __getitem__z _MagicFormatMapping.__getitem__ sp "99"C !
z#&
c((C|C s ,
99c * t | j S N)iterr9 r< s r? __iter__z _MagicFormatMapping.__iter__ s DL!!!rA c * t | j S rJ )lenr9 rL s r? __len__z_MagicFormatMapping.__len__ s 4< rA N)__name__
__module__ __qualname____doc__r@ rH rM rP rA r? r6 r6 } sZ
! ! !" " "! ! ! ! !rA r6 c t | t j t j f r | j dvrd S | j }t |t r|S d S )N)format
format_map)
isinstancetypes
MethodTypeBuiltinMethodTyperQ __self__r )callableobjs r? inspect_format_methodr` sa 5#U%<= ": : :t
C#|$$
rA c v t | }t | t k rt dt z |S )zWA range that can't generate ranges with a length of more than
MAX_RANGE items.
zDRange too big. The sandbox blocks ranges larger than MAX_RANGE (%d).)r
rO MAX_RANGE
OverflowError)r= rngs r?
safe_rangere sE d
C
3xx)
!*
+
JrA c d| _ | S )znMarks a function or method as unsafe.
::
@unsafe
def delete(self):
pass
T)unsafe_callable)fs r? unsaferi s A HrA c t | t j r
|t v rdS nt | t j r|t v s |t
v rdS nt | t r |dk rdS nt | t j t j t j f rdS t | t j
r |t v rdS nut t d r&t | t j
r |t v rdS n:t t d r%t | t j r |t v rdS | d S )a Test if the attribute given is an internal python attribute. For
example this function returns `True` for the `func_code` attribute of
python objects. This is useful if the environment method
:meth:`~SandboxedEnvironment.is_safe_attribute` is overridden.
>>> from jinja2.sandbox import is_internal_attribute
>>> is_internal_attribute(str, "mro")
True
>>> is_internal_attribute(str, "upper")
False
Tmro
CoroutineTypeAsyncGeneratorType__)rY rZ FunctionTypeUNSAFE_FUNCTION_ATTRIBUTESr[ UNSAFE_METHOD_ATTRIBUTEStypeCodeType
TracebackType FrameType
GeneratorTypeUNSAFE_GENERATOR_ATTRIBUTEShasattrrl UNSAFE_COROUTINE_ATTRIBUTESrm !UNSAFE_ASYNC_GENERATOR_ATTRIBUTES
startswith)r_ attrs r? is_internal_attributer} sh #u)** - - -4 . C) * * - - -9Q1Q1Q4 2R C 5==4 C%.%*=uO P P t C, - -
. . .4 / ( ( ZU=P-Q-Q . . .4 / , - - * U
%3 3 4 4 44 ??4 rA c L t D ]\ }}t | | r||v c S dS )a This function checks if an attribute on a builtin mutable object
(list, dict, set or deque) would modify it if called. It also supports
the "user"-versions of the objects (`sets.Set`, `UserDict.*` etc.) and
with Python 2.6 onwards the abstract base classes `MutableSet`,
`MutableMapping`, and `MutableSequence`.
>>> modifies_known_mutable({}, "clear")
True
>>> modifies_known_mutable({}, "keys")
False
>>> modifies_known_mutable([], "append")
True
>>> modifies_known_mutable([], "index")
False
If called with an unsupported object (such as unicode) `False` is
returned.
>>> modifies_known_mutable("foo", "upper")
False
F)
_mutable_specrY )r_ r| typespecri s r? modifies_known_mutabler sD , * " "& c8 $ $ "6> ! ! ! " 5rA c e Zd ZdZdZej ej ej ej ej
ej ej dZ
ej ej dZ e Z e Zd Zd Zd Zd Zd Zd
Zd Zd Zd
Z ddZ d Z dS )SandboxedEnvironmenta The sandboxed environment. It works like the regular environment but
tells the compiler to generate sandboxed code. Additionally subclasses of
this environment may override the methods that tell the runtime what
attributes or functions are safe to access.
If the template tries to access insecure code a :exc:`SecurityError` is
raised. However also other exceptions may occur during the rendering so
the caller has to ensure that all exceptions are caught.
T)+-*/z//z**%)r r c dS )a Called during template compilation with the name of a unary
operator to check if it should be intercepted at runtime. If this
method returns `True`, :meth:`call_unop` is executed for this unary
operator. The default implementation of :meth:`call_unop` will use
the :attr:`unop_table` dictionary to perform the operator with the
same logic as the builtin one.
The following unary operators are interceptable: ``+`` and ``-``
Intercepted calls are always slower than the native operator call,
so make sure only to intercept the ones you are interested in.
.. versionadded:: 2.6
FrU )r< operators r? intercept_unopz#SandboxedEnvironment.intercept_unopA s urA c t j | g|R i | t | j d< | j | _ | j | _ d S )Nrange) r r@ re globalsdefault_binop_tablecopy binop_tabledefault_unop_table
unop_tabler; s r? r@ z SandboxedEnvironment.__init__R s` T3D333F333 * W 388:: 16688rA c N | d pt || S )aY The sandboxed environment will call this method to check if the
attribute of an object is safe to access. Per default all attributes
starting with an underscore are considered private as well as the
special attributes of internal python objects as returned by the
:func:`is_internal_attribute` function.
_)r{ r} r< r_ r| values r? is_safe_attributez&SandboxedEnvironment.is_safe_attributeX s) OOC((L,A#t,L,LMMrA c H t |dd pt |dd S )a Check if an object is safely callable. Per default a function is
considered safe unless the `unsafe_callable` attribute exists and is
True. Override this method to alter the behavior, but this won't
affect the `unsafe` decorator from this module.
rg F alters_data)getattr)r< r_ s r? is_safe_callablez%SandboxedEnvironment.is_safe_callablea s0
C*E 2 2 Xgc=RW6X6X
rA c 0 | j | || S )zFor intercepted binary operator calls (:meth:`intercepted_binops`)
this function is executed instead of the builtin operator. This can
be used to fine tune the behavior of certain operators.
.. versionadded:: 2.6
)r )r< contextr leftrights r?
call_binopz SandboxedEnvironment.call_binopk s *t )$666rA c . | j | | S )zFor intercepted unary operator calls (:meth:`intercepted_unops`)
this function is executed instead of the builtin operator. This can
be used to fine tune the behavior of certain operators.
.. versionadded:: 2.6
)r )r< r r args r? call_unopz SandboxedEnvironment.call_unopt s )tx(---rA c || S # t t f$ r t |t rt t | } t || }| ||| r|cY S | || cY S # t $ r Y nw xY w# t $ r Y nw xY wY nw xY w|
|| S )z(Subscribe an object from sandboxed code.r_ name) TypeErrorrD rY r rE r r unsafe_undefinedAttributeError Exception undefined)r< r_ argumentr| r s r? getitemz SandboxedEnvironment.getitem} s Dx= ;' D D D(L11
D D x==DD 'T 2 2 11#xGG )#(LLL # 4 4S( C CCCC * ! D D ~~#H~555sV
&B'BBB',B'
BB'BB'
B! B' B!!B'&B'c t || }| ||| r|S | || S # t $ r% || cY S # t t
f$ r Y nw xY wY nw xY w| || S )zSubscribe an object from sandboxed code and prefer the
attribute. The attribute passed *must* be a bytestring.
r )r r r r r rD r )r< r_ attributer s r? r z SandboxedEnvironment.getattr s
9C++E %%c9e<<
((i88 8
9~%%% {+
~~#I~666s5 A
A0 AA0A*'A0)A**A0/A0c ` | d|d|j j d||t S )z1Return an undefined object for unsafe attributes.zaccess to attribute z of z object is unsafe.)r r_ exc)r __class__rQ r
)r< r_ r s r? r z%SandboxedEnvironment.unsafe_undefined sB ~~~#,99cm.D.D.D
F
rA Nc t |t rt | |j }nt | }|N|j dk rCt
| dk s|r$t dt
| |duz z |d }d}t || }| ||| } t | | S )zIf a format call is detected, then this is routed through this
method so that our safety sandbox can be used for it.
NrX r z0format_map() takes exactly one argument %d givenr ) rY r SandboxedEscapeFormatterescapeSandboxedFormatterrQ rO r r6 vformatrr )r< sr= r> format_func formatterrvs r?
format_stringz"SandboxedEnvironment.format_string s a 10qx@@II*400I "{';|'K'K4yyA~~~ F4yyF$$679
!WFD$T622
q$
/
/tAwwr{{rA c t | }|| |||| S | | st |d |j |g|R i |S )z#Call an object from sandboxed code.Nz is not safely callable)r` r r r
call)_SandboxedEnvironment__self _SandboxedEnvironment__context_SandboxedEnvironment__objr= r> fmts r? r zSandboxedEnvironment.call s~ #E** ?''T65AA A &&u-- H uuu FGG G y~e5d555f555rA rJ ) rQ rR rS rT sandboxedr r" submultruedivfloordivpowmodr posnegr frozensetintercepted_binopsintercepted_unopsr r@ r r r r r r r r r rU rA r? r r s6 I \
\
\
l
\ (|(,?? # " "9 9 9 N N N
7 7 7. . .6 6 6*7 7 7"
.
6
6
6
6
6rA r c e Zd ZdZd ZdS ) ImmutableSandboxedEnvironmentzWorks exactly like the regular `SandboxedEnvironment` but does not
permit modifications on the builtin mutable objects `list`, `set`, and
`dict` by using the :func:`modifies_known_mutable` function.
c b t | ||| sdS t || S )NF)r r r r s r? r z/ImmutableSandboxedEnvironment.is_safe_attribute s6 #55dCuMM 5)#t4444rA N)rQ rR rS rT r rU rA r? r r s-
5 5 5 5 5rA r )formatter_field_name_splitc * | S rJ )_formatter_field_name_split)
field_names r? r r s 55777rA c e Zd Zd Zd ZdS )SandboxedFormatterMixinc || _ d S rJ )_envr< envs r? r@ z SandboxedFormatterMixin.__init__ s
rA c t | \ }}| ||| }|D ]>\ }}|r | j || }#| j || }?||fS rJ )r get_valuer r r ) r< r r= r> firstrestr_ is_attris r? get_fieldz!SandboxedFormatterMixin.get_field s 0<< tnnUD&11 0 0JGQ
0i''Q//i''Q//EzrA N)rQ rR rS r@ r rU rA r? r r s2 rA r c e Zd Zd ZdS )r c d t | | t j | d S rJ )r r@ r r s r? r@ zSandboxedFormatter.__init__ s/ ((s3334 rA NrQ rR rS r@ rU rA r? r r s# ! ! ! ! !rA r c e Zd Zd ZdS )r c f t | | t j | | d S rJ )r r@ r )r< r r s r? r@ z!SandboxedEscapeFormatter.__init__ s1 ((s333 v.....rA Nr rU rA r? r r s# / / / / /rA r )=rT r rZ warnings collectionsr stringr
markupsafer r _compatr r r
r environmentr
exceptionsr
rb rp setrq rw ry rz filterwarningsDeprecationWarningrQ _mutable_set_typesdict_mutable_mapping_typeslist_mutable_sequence_typesr r r ImportErrorsetsr!
MutableSetMutableMappingMutableSequencer r Mappingr6 r` re ri r} r r r _stringr objectr r r rU rA r? <module>r s & & & & & & ! ! ! ! ! ! $ $ $ $ $ $ % % % % % %
'" " " "% >== *9 5 *9 5 &/
$; ! !3H V ' ,,,,,,,,!!!!!!x 338+% D 3& D s~' ' 3-/ / C /1 1
EEEFF
MMMNN
1(
V ! ! ! ! !#+ ! ! !>
"! "! "!J 8K6 K6 K6 K6 K6; K6 K6 K6\ 5 5 5 5 5$8 5 5 582222222 8 8 88 8 8 8 88 f ! ! ! ! !0) ! ! ! / / / / / 6 / / / / /s6 B( (B0/B04 C C C &E- -E87E8