Remove safe_eval

review616002

tryton/common/common.py

@@ -1463,60 +1463,6 @@ def filter_domain(domain):
             res.extend(filter_domain(arg))
     return res
 
-_ALLOWED_CODES = set(dis.opmap[x] for x in [
-        'POP_TOP', 'ROT_TWO', 'ROT_THREE', 'ROT_FOUR', 'DUP_TOP', 'BUILD_LIST',
-        'BUILD_MAP', 'BUILD_TUPLE', 'LOAD_CONST', 'RETURN_VALUE',
-        'STORE_SUBSCR', 'UNARY_POSITIVE', 'UNARY_NEGATIVE', 'UNARY_NOT',
-        'UNARY_INVERT', 'BINARY_POWER', 'BINARY_MULTIPLY', 'BINARY_DIVIDE',
-        'BINARY_FLOOR_DIVIDE', 'BINARY_TRUE_DIVIDE', 'BINARY_MODULO',
-        'BINARY_ADD', 'BINARY_SUBTRACT', 'BINARY_LSHIFT', 'BINARY_RSHIFT',
-        'BINARY_AND', 'BINARY_XOR', 'BINARY_OR', 'STORE_MAP', 'LOAD_NAME',
-        'CALL_FUNCTION', 'COMPARE_OP', 'LOAD_ATTR', 'STORE_NAME', 'GET_ITER',
-        'FOR_ITER', 'LIST_APPEND', 'JUMP_ABSOLUTE', 'DELETE_NAME',
-        'JUMP_IF_TRUE', 'JUMP_IF_FALSE', 'JUMP_IF_FALSE_OR_POP',
-        'JUMP_IF_TRUE_OR_POP', 'POP_JUMP_IF_FALSE', 'POP_JUMP_IF_TRUE',
-        'BINARY_SUBSCR',
-        ] if x in dis.opmap)
-
-_SAFE_EVAL_CACHE = {}
-
-
-def safe_eval(source, data=None):
-    if '__subclasses__' in source:
-        raise ValueError('__subclasses__ not allowed')
-    if hashlib:
-        key = hashlib.md5(source).digest()
-    else:
-        key = md5.new(source).digest()
-    c = _SAFE_EVAL_CACHE.get(key)
-    if not c:
-        c = compile(source, '', 'eval')
-        codes = []
-        s = c.co_code
-        i = 0
-        while i < len(s):
-            code = ord(s[i])
-            codes.append(code)
-            if code >= dis.HAVE_ARGUMENT:
-                i += 3
-            else:
-                i += 1
-        for code in codes:
-            if code not in _ALLOWED_CODES:
-                raise ValueError('opcode %s not allowed' % dis.opname[code])
-        if len(_SAFE_EVAL_CACHE) > 1024:
-            _SAFE_EVAL_CACHE.clear()
-        _SAFE_EVAL_CACHE[key] = c
-    return eval(c, {'__builtins__': {
-        'True': True,
-        'False': False,
-        'str': str,
-        'globals': locals,
-        'locals': locals,
-        'bool': bool,
-        'dict': dict,
-        }}, data)
-
 
 def timezoned_date(date, reverse=False):
     if pytz and rpc.CONTEXT.get('timezone') and rpc.TIMEZONE:

tryton/gui/window/view_form/view/graph_gtk/line.py

@@ -3,7 +3,7 @@
 #This code is inspired by the pycha project
 #(http://www.lorenzogil.com/projects/pycha/)
 from graph import Graph
-from tryton.common import hex2rgb, float_time_to_text, safe_eval
+from tryton.common import hex2rgb, float_time_to_text
 import locale
 import math
 import cairo
@@ -34,7 +34,7 @@ class Line(Graph):
                 if self.xrange == 0:
                     x = 1.0
 
-                if (not bool(safe_eval(yfield2attrs[yfield].get('empty', '1')))
+                if (not bool(int(yfield2attrs[yfield].get('empty', 1)))
                         and yval == 0):
                     continue
 
@@ -50,7 +50,7 @@ class Line(Graph):
         key2interpolation = {}
         for yfield in self.yfields:
             key = yfield.get('key', yfield['name'])
-            key2fill[key] = bool(safe_eval(yfield.get('fill', '0')))
+            key2fill[key] = bool(int(yfield.get('fill', 0)))
             key2interpolation[key] = yfield.get('interpolation', 'linear')
 
         def preparePath(key):

tryton/gui/window/view_form/view/graph_gtk/pie.py

@@ -5,7 +5,7 @@
 from graph import Graph, Area
 import math
 import cairo
-from tryton.common import hex2rgb, float_time_to_text, safe_eval
+from tryton.common import hex2rgb, float_time_to_text
 import locale
 import tryton.rpc as rpc
 
@@ -91,7 +91,7 @@ class Pie(Graph):
         cr.save()
         for slice in self.slices:
             if slice.isBigEnough():
-                if bool(safe_eval(self.yfields[0].get('fill', '1'))):
+                if bool(int(self.yfields[0].get('fill', 1))):
                     color = self.colorScheme[slice.xname]
                     if slice.highlight:
                         color = self.colorScheme['__highlight']