[Zope-Checkins] SVN: Zope/branches/2.12/ LP #1047318: Tighten import restrictions for restricted code.

Hano Schlichting cvs-admin at zope.org
Sun Sep 9 12:55:30 UTC 2012


Log message for revision 127792:
  LP #1047318: Tighten import restrictions for restricted code.
  

Changed:
  U   Zope/branches/2.12/doc/CHANGES.rst
  U   Zope/branches/2.12/setup.py
  U   Zope/branches/2.12/src/AccessControl/SecurityInfo.py
  U   Zope/branches/2.12/src/AccessControl/ZopeGuards.py
  U   Zope/branches/2.12/src/AccessControl/__init__.py
  U   Zope/branches/2.12/src/AccessControl/tests/testModuleSecurity.py
  U   Zope/branches/2.12/src/AccessControl/tests/testZopeGuards.py
  U   Zope/branches/2.12/src/Products/PythonScripts/standard.py
  U   Zope/branches/2.12/src/Products/PythonScripts/tests/testPythonScript.py

-=-
Modified: Zope/branches/2.12/doc/CHANGES.rst
===================================================================
--- Zope/branches/2.12/doc/CHANGES.rst	2012-09-09 11:13:26 UTC (rev 127791)
+++ Zope/branches/2.12/doc/CHANGES.rst	2012-09-09 12:55:26 UTC (rev 127792)
@@ -5,9 +5,11 @@
 Change information for previous versions of Zope can be found at
 http://docs.zope.org/zope2/releases/.
 
-2.12.24 (unreleased)
+2.12.24 (2012-09-09)
 --------------------
 
+- LP #1047318: Tighten import restrictions for restricted code.
+
 - Fix a bug in ZopeSecurityPolicy.py. Global variable `rolesForPermissionOn`
   could be overridden if `__role__` had custom rolesForPermissionOn.
 

Modified: Zope/branches/2.12/setup.py
===================================================================
--- Zope/branches/2.12/setup.py	2012-09-09 11:13:26 UTC (rev 127791)
+++ Zope/branches/2.12/setup.py	2012-09-09 12:55:26 UTC (rev 127792)
@@ -16,7 +16,7 @@
 from setuptools import setup, find_packages, Extension
 
 setup(name='Zope2',
-    version='2.12.24dev',
+    version='2.12.24',
     url='http://www.zope.org',
     license='ZPL 2.1',
     description='Zope2 application server / web framework',

Modified: Zope/branches/2.12/src/AccessControl/SecurityInfo.py
===================================================================
--- Zope/branches/2.12/src/AccessControl/SecurityInfo.py	2012-09-09 11:13:26 UTC (rev 127791)
+++ Zope/branches/2.12/src/AccessControl/SecurityInfo.py	2012-09-09 12:55:26 UTC (rev 127792)
@@ -211,7 +211,9 @@
 def secureModule(mname, *imp):
     modsec = _moduleSecurity.get(mname, None)
     if modsec is None:
-        return
+        if mname in _appliedModuleSecurity:
+            return sys.modules[mname]
+        return # no MSI, no module
 
     if imp:
         __import__(mname, *imp)

Modified: Zope/branches/2.12/src/AccessControl/ZopeGuards.py
===================================================================
--- Zope/branches/2.12/src/AccessControl/ZopeGuards.py	2012-09-09 11:13:26 UTC (rev 127791)
+++ Zope/branches/2.12/src/AccessControl/ZopeGuards.py	2012-09-09 12:55:26 UTC (rev 127792)
@@ -310,7 +310,7 @@
             return list.sorted(iterable, cmp=None, key=None, reverse=False)
 safe_builtins['list'] = GuardedListType()
 
-            
+
 class GuardedDictType:
     def __call__(self, *args, **kwargs):
         return dict(*args, **kwargs)
@@ -329,20 +329,16 @@
 safe_builtins['sum'] = guarded_sum
 
 def load_module(module, mname, mnameparts, validate, globals, locals):
-    modules = sys.modules
     while mnameparts:
         nextname = mnameparts.pop(0)
         if mname is None:
             mname = nextname
         else:
             mname = '%s.%s' % (mname, nextname)
-        nextmodule = modules.get(mname, None)
-        if nextmodule is None:
-            nextmodule = secureModule(mname, globals, locals)
-            if nextmodule is None:
-                return
-        else:
-            secureModule(mname)
+        # import (if not already imported) and  check for MSI
+        nextmodule = secureModule(mname, globals, locals)
+        if nextmodule is None: # not allowed
+            return
         if module and not validate(module, module, nextname, nextmodule):
             return
         module = nextmodule
@@ -440,7 +436,7 @@
 def __idiv__(x, y):
     x /= y
     return x
- 
+
 def __ifloordiv__(x, y):
     x //= y
     return x

Modified: Zope/branches/2.12/src/AccessControl/__init__.py
===================================================================
--- Zope/branches/2.12/src/AccessControl/__init__.py	2012-09-09 11:13:26 UTC (rev 127791)
+++ Zope/branches/2.12/src/AccessControl/__init__.py	2012-09-09 12:55:26 UTC (rev 127792)
@@ -26,11 +26,18 @@
 from AccessControl.SecurityInfo import allow_module
 from AccessControl.SecurityInfo import allow_class
 from AccessControl.SimpleObjectPolicies import allow_type
-from AccessControl.unauthorized import Unauthorized  # XXX 
+from AccessControl.unauthorized import Unauthorized
 from AccessControl.ZopeGuards import full_write_guard
 from AccessControl.ZopeGuards import safe_builtins
 
 ModuleSecurityInfo('AccessControl').declarePublic('getSecurityManager')
 
+# allow imports of utility_builtins
+
+for name in ('string', 'math', 'random', 'sets'):
+    ModuleSecurityInfo(name).setDefaultAccess('allow')
+
+ModuleSecurityInfo('DateTime').declarePublic('DateTime')
+
 from AccessControl import DTML  # XXX side effects?
 del DTML

Modified: Zope/branches/2.12/src/AccessControl/tests/testModuleSecurity.py
===================================================================
--- Zope/branches/2.12/src/AccessControl/tests/testModuleSecurity.py	2012-09-09 11:13:26 UTC (rev 127791)
+++ Zope/branches/2.12/src/AccessControl/tests/testModuleSecurity.py	2012-09-09 12:55:26 UTC (rev 127792)
@@ -42,6 +42,9 @@
         from AccessControl.ZopeGuards import guarded_import
         guarded_import(module, fromlist=fromlist, level=level)
 
+    def test_unprotected_module(self):
+        self.assertUnauth('os', ())
+
     def testPrivateModule(self):
         self.assertUnauth('AccessControl.tests.private_module', ())
         self.assertUnauth('AccessControl.tests.private_module', ('priv',))

Modified: Zope/branches/2.12/src/AccessControl/tests/testZopeGuards.py
===================================================================
--- Zope/branches/2.12/src/AccessControl/tests/testZopeGuards.py	2012-09-09 11:13:26 UTC (rev 127791)
+++ Zope/branches/2.12/src/AccessControl/tests/testZopeGuards.py	2012-09-09 12:55:26 UTC (rev 127792)
@@ -761,10 +761,6 @@
         g['__name__'] = __name__ # so classes can be defined in the script
         return code, g
 
-    def testPythonRealAC(self):
-        code, its_globals = self._compile("actual_python.py")
-        exec code in its_globals
-
     # Compile code in fname, as restricted Python. Return the
     # compiled code, and a safe globals dict for running it in.
     # fname is the string name of a Python file; it must be found

Modified: Zope/branches/2.12/src/Products/PythonScripts/standard.py
===================================================================
--- Zope/branches/2.12/src/Products/PythonScripts/standard.py	2012-09-09 11:13:26 UTC (rev 127791)
+++ Zope/branches/2.12/src/Products/PythonScripts/standard.py	2012-09-09 12:55:26 UTC (rev 127792)
@@ -40,7 +40,7 @@
 from DocumentTemplate.DT_Var import restructured_text
 from ZPublisher.HTTPRequest import record
 
-security = ModuleSecurityInfo()
+security = ModuleSecurityInfo('Products.PythonScripts.standard')
 
 security.declarePublic('special_formats',
                        'whole_dollars',

Modified: Zope/branches/2.12/src/Products/PythonScripts/tests/testPythonScript.py
===================================================================
--- Zope/branches/2.12/src/Products/PythonScripts/tests/testPythonScript.py	2012-09-09 11:13:26 UTC (rev 127791)
+++ Zope/branches/2.12/src/Products/PythonScripts/tests/testPythonScript.py	2012-09-09 12:55:26 UTC (rev 127792)
@@ -131,9 +131,6 @@
     def testCollector2295(self):
         res = self._newPS('if False:\n  pass\n#hi')
 
-    def testCollector2295(self):
-        res = self._newPS('if False:\n  pass\n#hi')
-
     def testReduce(self):
         res = self._newPS('return reduce(lambda x, y: x + y, [1,3,5,7])')()
         self.assertEqual(res, 16)



More information about the Zope-Checkins mailing list