Compare commits

...

3 Commits

Author SHA1 Message Date
Sarah Hoffmann
67ecf5f6a0 Merge pull request #3943 from Itz-Agasta/test_fix
Tests: Replace eval() with ast.literal_eval() for safer parsing
2026-01-25 10:10:15 +01:00
Itz-Agasta
e77a4c2f35 Switch to ast.literal_eval for dict parsing
Due to  some test data in the BDD feature files includes Python raw strings and escape sequences that standard json.loads() cannot parse switching to safer Python literal evaluation
for converting string representations of dictionaries.
2026-01-24 15:32:47 +05:30
Itz-Agasta
9fa980bca2 Replaces eval with json.loads for safer dict parsing
Switches from eval to json.loads when parsing string representations
of dictionaries to  prevent arbitrary code
execution.
2026-01-24 15:32:47 +05:30
2 changed files with 5 additions and 2 deletions

View File

@@ -7,6 +7,7 @@
""" """
Helper functions to compare expected values. Helper functions to compare expected values.
""" """
import ast
import collections.abc import collections.abc
import json import json
import re import re
@@ -58,7 +59,8 @@ COMPARISON_FUNCS = {
None: lambda val, exp: str(val) == exp, None: lambda val, exp: str(val) == exp,
'i': lambda val, exp: str(val).lower() == exp.lower(), 'i': lambda val, exp: str(val).lower() == exp.lower(),
'fm': lambda val, exp: re.fullmatch(exp, val) is not None, 'fm': lambda val, exp: re.fullmatch(exp, val) is not None,
'dict': lambda val, exp: val is None if exp == '-' else (val == eval('{' + exp + '}')), 'dict': lambda val, exp: (val is None if exp == '-'
else (val == ast.literal_eval('{' + exp + '}'))),
'in_box': within_box 'in_box': within_box
} }

View File

@@ -7,6 +7,7 @@
""" """
Helper classes for filling the place table. Helper classes for filling the place table.
""" """
import ast
import random import random
import string import string
@@ -51,7 +52,7 @@ class PlaceColumn:
elif key.startswith('addr+'): elif key.startswith('addr+'):
self._add_hstore('address', key[5:], value) self._add_hstore('address', key[5:], value)
elif key in ('name', 'address', 'extratags'): elif key in ('name', 'address', 'extratags'):
self.columns[key] = eval('{' + value + '}') self.columns[key] = ast.literal_eval('{' + value + '}')
else: else:
assert key in ('class', 'type'), "Unknown column '{}'.".format(key) assert key in ('class', 'type'), "Unknown column '{}'.".format(key)
self.columns[key] = None if value == '' else value self.columns[key] = None if value == '' else value