Skip to content

Refactor allowed functions to a dictionary for safety #2978

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
doomedraven merged 2 commits into from
Apr 20, 2026
Merged

Refactor allowed functions to a dictionary for safety #2978

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7c59019
Refactor allowed functions to a dictionary for safety
doomedraven Apr 16, 2026
315cf2e
Update views.py
doomedraven Apr 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 8 additions & 3 deletions web/submission/views.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,12 @@

logger = logging.getLogger(__name__)

allowed_functions = {
"sorted": sorted,
"set": set,
"os.path.join": os.path.join,
}


def parse_expr(expr, context):
"""Return the value from a python AST expression.
Expand Down Expand Up @@ -88,11 +94,10 @@ def parse_expr(expr, context):
# Figure out what function is being called, with what arguments.
func = parse_expr(expr.func, context)
args = tuple([parse_expr(item, context) for item in expr.args])
# We deem these functions safe to use with "eval".
allowed_functions = ("sorted", "set", "os.path.join")

if func in allowed_functions:
# Actually call the function, passing the args, and return the result.
return eval(f"{func}{args}")
return allowed_functions[func](*args)
# Don't execute the call, but instead, give back a string representation.
return f"<{func}{args}>"
if isinstance(expr, ast.BinOp) and isinstance(expr.op, ast.Add):
Expand Down
Loading