]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
bpo-41944: No longer call eval() on content received via HTTP in the UnicodeNames...
authorFlorian Bruhin <me@the-compiler.org>
Tue, 6 Oct 2020 14:21:56 +0000 (16:21 +0200)
committerGitHub <noreply@github.com>
Tue, 6 Oct 2020 14:21:56 +0000 (16:21 +0200)
commita8bf44d04915f7366d9f8dfbf84822ac37a4bab3
tree125751f9aff69c9fcdca241b285ff0827cbf30e7
parent2ef5caa58febc8968e670e39e3d37cf8eef3cab8
bpo-41944: No longer call eval() on content received via HTTP in the UnicodeNames tests (GH-22575)

Similarly to GH-22566, those tests called eval() on content received via
HTTP in test_named_sequences_full. This likely isn't exploitable because
unicodedata.lookup(seqname) is called before self.checkletter(seqname,
None) - thus any string which isn't a valid unicode character name
wouldn't ever reach the checkletter method.

Still, it's probably better to be safe than sorry.
Lib/test/test_ucn.py