9.8 $ˆl–Ðz¾”d*hŠm@·q—îå1hß „ ­²ßÁÀ¿?÷# -*- coding: utf-8 -*- """A sandbox layer that ensures unsafe operations cannot be performed. Useful when the template itself comes from an untrusted source. """ import operator import types import warnings from collections import deque from functools import update_wrapper from string import Formatter from markupsafe import EscapeFormatter from markupsafe import Markup from ._compat import abc from ._compat import PY2 from ._compat import range_type from ._compat import string_types from .environment import Environment from .exceptions import SecurityError #: maximum number of items a range may produce MAX_RANGE = 100000 #: attributes of function objects that are considered unsafe. if PY2: UNSAFE_FUNCTION_ATTRIBUTES = { "func_closure", "func_code", "func_dict", "func_defaults", "func_globals", } else: # On versions > python 2 the special attributes on functions are gone, # but they remain on methods and generators for whatever reason. UNSAFE_FUNCTION_ATTRIBUTES = set() #: unsafe method attributes. function attributes are unsafe for methods too UNSAFE_METHOD_ATTRIBUTES = {"im_class", "im_func", "im_self"} #: unsafe generator attributes. UNSAFE_GENERATOR_ATTRIBUTES = {"gi_frame", "gi_code"} #: unsafe attributes on coroutines UNSAFE_COROUTINE_ATTRIBUTES = {"cr_frame", "cr_code"} #: unsafe attributes on async generators UNSAFE_ASYNC_GENERATOR_ATTRIBUTES = {"ag_code", "ag_frame"} # make sure we don't warn in python 2.6 about stuff we don't care about warnings.filterwarnings( "ignore", "the sets module", DeprecationWarning, module=__name__ ) _mutable_set_types = (set,) _mutable_mapping_types = (dict,) _mutable_sequence_types = (list,) # on python 2.x we can register the user collection types try: from UserDict import UserDict, DictMixin from UserList import UserList _mutable_mapping_types += (UserDict, DictMixin) _mutable_set_types += (UserList,) except ImportError: pass # if sets is still available, register the mutable set from there as well try: from sets import Set _mutable_set_types += (Set,) except ImportError: pass #: register Python 2.6 abstract base classes _mutable_set_types += (abc.MutableSet,) _mutable_mapping_types += (abc.MutableMapping,) _mutable_sequence_types += (abc.MutableSequence,) _mutable_spec = ( ( _mutable_set_types, frozenset( [ "add", "clear", "difference_update", "discard", "pop", "remove", "symmetric_difference_update", "update", ] ), ), ( _mutable_mapping_types, frozenset(["clear", "pop", "popitem", "setdefault", "update"]), ), ( _mutable_sequence_types, frozenset(["append", "reverse", "insert", "sort", "extend", "remove"]), ), ( deque, frozenset( [ "append", "appendleft", "clear", "extend", "extendleft", "pop", "popleft", "remove", "rotate", ] ), ), ) class _MagicFormatMapping(abc.Mapping): """This class implements a dummy wrapper to fix a bug in the Python standard library for string formatting. See https://bugs.python.org/issue13598 for information about why this is necessary. """ def __init__(self, args, kwargs): self._args = args self._kwargs = kwargs self._last_index = 0 def __getitem__(self, key): if key == "": idx = self._last_index self._last_index += 1 try: return self._args[idx] except LookupError: pass key = str(idx) return self._kwargs[key] def __iter__(self): return iter(self._kwargs) def __len__(self): r