id summary reporter owner description type status priority milestone component resolution keywords cc merged author reviewer upstream work_issues branch commit dependencies stopgaps
2877 security risk -- restrict the input of eval in CC constructor robertwb cwitty "There are valid uses for eval() and sage_eval(), it makes it much easier to parse output from interfaces for example.
It is difficult (if not impossible) to completely sanitize arbitrary input, but one should be able to (say) write a backend that takes specific data, calls on Sage to process it, and then returns the result. For example, I might want a webpage that uses Sage to compute Julia sets, and takes as input a complex number. That the following work is scary
{{{
sage: CC(""os.getpid()"")
10324.0000000000
sage: CC(""os.mkdir('a')"")
NaN - NaN*I
sage: CC(""os.rmdir('a')"")
NaN - NaN*I
sage: CC(""os.exec(...)"")
}}}
In this ticket, one introduces restrictions on the text input to CC that prevent most of these terrible examples." enhancement closed major sage-9.5 misc fixed tscrim slelievre gh-kliem klee Frédéric Chapoton Travis Scrimshaw, Kwankyu Lee N/A 57e8e9bc41c8e41eca5cad8879e67ba49089a4f0 57e8e9bc41c8e41eca5cad8879e67ba49089a4f0