Merge pull request #608 from HttpRunner/fix_eval

Fix eval
2026-05-12 02:21:29 +08:00 · 2019-06-04 13:23:45 +08:00
parent a8b0159f40 3148720a55
commit 4272b98210
9 changed files with 68 additions and 8 deletions
--- a/.travis.yml
+++ b/.travis.yml
@@ -11,7 +11,7 @@ matrix:
      dist: xenial
      sudo: true
 install:
-  - pip install pipenv --upgrade-strategy=only-if-needed
+  - pip install pipenv --upgrade
  - pipenv install --dev --skip-lock
 script:
  - pipenv run python setup.py install
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Release History

+## 2.1.3 (2019-04-24)
+
+**Bugfixes**
+
+- replace eval mechanism with builtins to prevent security vulnerabilities
+
 ## 2.1.2 (2019-04-17)

 **Features**
--- a/README.md
+++ b/README.md
@@ -36,7 +36,7 @@ HttpRunner is rich documented.
 ## How to Contribute

 1. Check for [open issues](https://github.com/HttpRunner/HttpRunner/issues) or [open a fresh issue](https://github.com/HttpRunner/HttpRunner/issues/new/choose) to start a discussion around a feature idea or a bug.
-2. Fork [the repository](https://github.com/httprunner/httprunner) on GitHub to start making your changes to the **master** branch (or branch off of it).
+2. Fork [the repository](https://github.com/httprunner/httprunner) on GitHub to start making your changes to the **master** branch (or branch off of it). You also need to comply with the [development rules](docs/dev-rules.md).
 3. Write a test which shows that the bug was fixed or that the feature works as expected.
 4. Send a pull request, you will then become a [contributor](https://github.com/HttpRunner/HttpRunner/graphs/contributors) after it gets merged and published.

--- a/docs/dev-rules.md
+++ b/docs/dev-rules.md
@@ -0,0 +1,47 @@
+
+## 版本号（Version）
+
+从 2.0 版本开始，HttpRunner 开始使用 [`Semantic Versioning`][SemVer] 版本号机制。该机制由 GitHub 联合创始人 Tom Preston-Werner 编写，当前被广泛采用，遵循该机制也可以更好地与开源生态统一，避免出现 “dependency hell” 的情况。
+
+具体地，HttpRunner 将采用 `MAJOR.MINOR.PATCH` 的版本号机制。
+
+- MAJOR: 重大版本升级并出现前后版本不兼容时加 1
+- MINOR: 大版本内新增功能并且保持版本内兼容性时加 1
+- PATCH: 功能迭代过程中进行问题修复（bugfix）时加 1
+
+当然，在实际迭代开发过程中，肯定也不会每次提交（commit）都对 PATCH 加 1；在遵循如上主体原则的前提下，也会根据需要，在版本号后面添加先行版本号（-alpha/beta/rc）或版本编译元数据（+20190101）作为延伸。
+
+## 分支策略
+
+HttpRunner 的开发分支策略采用 GitHub Flow。
+
+![](images/github-flow.png)
+
+## 提交信息（Commit Message）
+
+代码提交的注释信息遵循如下格式规范：
+
+```xml
+<type>(<scope>): <subject>
+<BLANK LINE>
+<body>
+<BLANK LINE>
+<footer>
+```
+
+- **type**【必填】，大致分类如下：
+    - feat：新功能（feature）
+    - fix：修补 bug
+    - docs：文档（documentation）
+    - style： 格式（不影响代码运行的变动）
+    - perf：性能提升
+    - refactor：重构（即不是新增功能，也不是修改 bug 的代码变动）
+    - test：增加测试
+    - build：构建过程或辅助工具的变动
+- **subject**【必填】，对提交内容的简要概述
+- scope【可选项】，用于说明 commit 影响的范围，视项目而定，一般建议写对应具体模块
+- body【可选项】，对提交内容的详细描述
+- footer【可选项】，一般为BREAKING CHANGE或关联的issue等内容 详见参考文档
+
+
+[SemVer]: https://semver.org/
--- a/docs/images/github-flow.png
+++ b/docs/images/github-flow.png
--- a/httprunner/about.py
+++ b/httprunner/about.py
@@ -1,7 +1,7 @@
 __title__ = 'HttpRunner'
 __description__ = 'One-stop solution for HTTP(S) testing.'
 __url__ = 'https://github.com/HttpRunner/HttpRunner'
-__version__ = '2.1.2'
+__version__ = '2.1.3'
 __author__ = 'debugtalk'
 __author_email__ = 'mail@debugtalk.com'
 __license__ = 'Apache-2.0'
--- a/httprunner/parser.py
+++ b/httprunner/parser.py
@@ -1,6 +1,7 @@
 # encoding: utf-8

 import ast
+import builtins
 import os
 import re

@@ -277,11 +278,8 @@ def get_mapping_function(function_name, functions_mapping):

    try:
        # check if Python builtin functions
-        item_func = eval(function_name)
-        if callable(item_func):
-            # is builtin function
-            return item_func
-    except (NameError, TypeError):
+        return getattr(builtins, function_name)
+    except AttributeError:
        # is not builtin function
        raise exceptions.FunctionNotFound("{} is not found.".format(function_name))

--- a/setup.py
+++ b/setup.py
@@ -25,6 +25,11 @@ install_requires = [
    "filetype"
 ]

+# Python 2.x?
+is_py2 = (sys.version_info[0] == 2)
+if is_py2:
+    install_requires.append("future")
+
 class UploadCommand(Command):
    """ Build and publish this package.
        Support setup.py upload. Copied from requests_html.
--- a/tests/test_parser.py
+++ b/tests/test_parser.py
@@ -437,6 +437,10 @@ class TestParserBasic(unittest.TestCase):
        self.assertEqual(var._string, "ABC{}{}")
        self.assertEqual(var.to_value(variables_mapping), "ABCTrueabc123")

+        # Python builtin functions
+        var = parser.LazyString("ABC${ord(a)}DEF${len(abcd)}", functions_mapping, check_variables_set)
+        self.assertEqual(var._string, "ABC{}DEF{}")
+        self.assertEqual(var.to_value(variables_mapping), "ABC97DEF4")

    def test_parse_variable(self):
        """ variable format ${var} and $var