From a3cc072c36bd1e360d3912acf06b4d62c239c2e0 Mon Sep 17 00:00:00 2001 From: debugtalk Date: Wed, 24 Apr 2019 15:43:57 +0800 Subject: [PATCH 1/4] fix: replace eval mechanism with builtins to prevent security vulnerabilities --- CHANGELOG.md | 6 ++++++ httprunner/__about__.py | 2 +- httprunner/parser.py | 8 +++----- tests/test_parser.py | 4 ++++ 4 files changed, 14 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index dfcfbf06..6e82d6d1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,11 @@ # Release History +## 2.1.3 (2019-04-24) + +**Bugfixes** + +- replace eval mechanism with builtins to prevent security vulnerabilities + ## 2.1.2 (2019-04-17) **Features** diff --git a/httprunner/__about__.py b/httprunner/__about__.py index 2a95ad4c..74d0888b 100644 --- a/httprunner/__about__.py +++ b/httprunner/__about__.py @@ -1,7 +1,7 @@ __title__ = 'HttpRunner' __description__ = 'One-stop solution for HTTP(S) testing.' __url__ = 'https://github.com/HttpRunner/HttpRunner' -__version__ = '2.1.2' +__version__ = '2.1.3' __author__ = 'debugtalk' __author_email__ = 'mail@debugtalk.com' __license__ = 'Apache-2.0' diff --git a/httprunner/parser.py b/httprunner/parser.py index 08c0bdbd..3fefb84b 100644 --- a/httprunner/parser.py +++ b/httprunner/parser.py @@ -1,6 +1,7 @@ # encoding: utf-8 import ast +import builtins import os import re @@ -277,11 +278,8 @@ def get_mapping_function(function_name, functions_mapping): try: # check if Python builtin functions - item_func = eval(function_name) - if callable(item_func): - # is builtin function - return item_func - except (NameError, TypeError): + return getattr(builtins, function_name) + except AttributeError: # is not builtin function raise exceptions.FunctionNotFound("{} is not found.".format(function_name)) diff --git a/tests/test_parser.py b/tests/test_parser.py index 0675f198..69147c50 100644 --- a/tests/test_parser.py +++ b/tests/test_parser.py @@ -437,6 +437,10 @@ class TestParserBasic(unittest.TestCase): self.assertEqual(var._string, "ABC{}{}") self.assertEqual(var.to_value(variables_mapping), "ABCTrueabc123") + # Python builtin functions + var = parser.LazyString("ABC${ord(a)}DEF${len(abcd)}", functions_mapping, check_variables_set) + self.assertEqual(var._string, "ABC{}DEF{}") + self.assertEqual(var.to_value(variables_mapping), "ABC97DEF4") def test_parse_variable(self): """ variable format ${var} and $var From 003cceed698ae17dcfb05181eae48b8a5b6d0fde Mon Sep 17 00:00:00 2001 From: debugtalk Date: Wed, 24 Apr 2019 16:14:49 +0800 Subject: [PATCH 2/4] fix: ImportError for builtins in Python2.7 --- setup.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/setup.py b/setup.py index 9e118d2b..b0c5dfa0 100644 --- a/setup.py +++ b/setup.py @@ -25,6 +25,11 @@ install_requires = [ "filetype" ] +# Python 2.x? +is_py2 = (sys.version_info[0] == 2) +if is_py2: + install_requires.append("future") + class UploadCommand(Command): """ Build and publish this package. Support setup.py upload. Copied from requests_html. From 460f12874c201908cba9a6491d407107fa394385 Mon Sep 17 00:00:00 2001 From: debugtalk Date: Wed, 24 Apr 2019 17:29:37 +0800 Subject: [PATCH 3/4] add dev-rules docs --- README.md | 2 +- docs/dev-rules.md | 47 ++++++++++++++++++++++++++++++++++++ docs/images/github-flow.png | Bin 0 -> 21040 bytes 3 files changed, 48 insertions(+), 1 deletion(-) create mode 100644 docs/dev-rules.md create mode 100644 docs/images/github-flow.png diff --git a/README.md b/README.md index 1368b69b..44d5824c 100644 --- a/README.md +++ b/README.md @@ -36,7 +36,7 @@ HttpRunner is rich documented. ## How to Contribute 1. Check for [open issues](https://github.com/HttpRunner/HttpRunner/issues) or [open a fresh issue](https://github.com/HttpRunner/HttpRunner/issues/new/choose) to start a discussion around a feature idea or a bug. -2. Fork [the repository](https://github.com/httprunner/httprunner) on GitHub to start making your changes to the **master** branch (or branch off of it). +2. Fork [the repository](https://github.com/httprunner/httprunner) on GitHub to start making your changes to the **master** branch (or branch off of it). You also need to comply with the [development rules](docs/dev-rules.md). 3. Write a test which shows that the bug was fixed or that the feature works as expected. 4. Send a pull request, you will then become a [contributor](https://github.com/HttpRunner/HttpRunner/graphs/contributors) after it gets merged and published. diff --git a/docs/dev-rules.md b/docs/dev-rules.md new file mode 100644 index 00000000..f9dfb589 --- /dev/null +++ b/docs/dev-rules.md @@ -0,0 +1,47 @@ + +## 版本号（Version） + +从 2.0 版本开始，HttpRunner 开始使用 [`Semantic Versioning`][SemVer] 版本号机制。该机制由 GitHub 联合创始人 Tom Preston-Werner 编写，当前被广泛采用，遵循该机制也可以更好地与开源生态统一，避免出现 “dependency hell” 的情况。 + +具体地，HttpRunner 将采用 `MAJOR.MINOR.PATCH` 的版本号机制。 + +- MAJOR: 重大版本升级并出现前后版本不兼容时加 1 +- MINOR: 大版本内新增功能并且保持版本内兼容性时加 1 +- PATCH: 功能迭代过程中进行问题修复（bugfix）时加 1 + +当然，在实际迭代开发过程中，肯定也不会每次提交（commit）都对 PATCH 加 1；在遵循如上主体原则的前提下，也会根据需要，在版本号后面添加先行版本号（-alpha/beta/rc）或版本编译元数据（+20190101）作为延伸。 + +## 分支策略 + +HttpRunner 的开发分支策略采用 GitHub Flow。 + +![](images/github-flow.png) + +## 提交信息（Commit Message） + +代码提交的注释信息遵循如下格式规范： + +```xml +(): + + + +