• Guido van Rossum's avatar
    Address SF bug #577530: del __builtins__ breaks out of rexec · 7f7c3d0a
    Guido van Rossum yazdı
    Using the suggestion there: add_module() forces __builtin__ back; this
    fixes r_exec, r_eval, r_execfile.  The interactive console had to be
    fixed separately, because it doesn't use r_exec, but relies on the
    'locals' dict having the right __builtins__.  Fixed this by
    subclassing InteractiveConsole and overriding runcode(), which does
    the exec.  This changes the banner output slightly: instead of
    starting with *** RESTRICTED ***, a subtler (RestrictedConsole) is
    printed before the first >>> prompt.
    
    Also import readline (if it exists) when the interactive console is
    used, for more convenient input editing and history.
    
    This does not mean that rexec is now considered safe!  But for those
    willing to take the risk, it's safer than before.  (Note that a safety
    analysis of the code module would be wise if you plan to use the
    interactive console for real -- I've only ever used it to play with
    restricted mode.)
    
    This should be backported to 2.2 and 2.1.
    7f7c3d0a
rexec.py 19.4 KB