1
0
forked from VimPlug/jedi

Remove a possible security issue

sys paths are not executed anymore and use static analysis now.
This commit is contained in:
Dave Halter
2017-10-05 19:57:50 +02:00
parent aa8a6d2482
commit 7019ca643e
4 changed files with 29 additions and 41 deletions

View File

@@ -7,8 +7,6 @@ sys.path.insert(0, '../../jedi')
sys.path.append(dirname(os.path.abspath('thirdparty' + os.path.sep + 'asdf')))
# modifications, that should fail:
# because of sys module
sys.path.append(sys.path[1] + '/thirdparty')
# syntax err
sys.path.append('a' +* '/thirdparty')
@@ -18,8 +16,9 @@ import evaluate
#? ['evaluator_function_cache']
evaluate.Evaluator_fu
#? ['jedi_']
# Those don't work because dirname and abspath are not properly understood.
##? ['jedi_']
import jedi_
#? ['el']
##? ['el']
jedi_.el

View File

@@ -4,10 +4,18 @@ Tests of ``jedi.api.Interpreter``.
import pytest
import jedi
from jedi._compatibility import is_py33, exec_function, py_version
from jedi._compatibility import is_py33, is_py3
from jedi.evaluate.compiled import mixed
if is_py3:
def exec_(source, global_map):
exec(source, global_map)
else:
eval(compile("""def exec_(source, global_map):
exec source in global_map """, 'blub', 'exec'))
class _GlobalNameSpace():
class SideEffectContainer():
pass
@@ -247,7 +255,7 @@ def test_completion_param_annotations():
# Need to define this function not directly in Python. Otherwise Jedi is to
# clever and uses the Python code instead of the signature object.
code = 'def foo(a: 1, b: str, c: int = 1.0): pass'
exec_function(code, locals())
exec_(code, locals())
script = jedi.Interpreter('foo', [locals()])
c, = script.completions()
a, b, c = c.params