Mercurial > cpython-lru_cache-weakref
diff Lib/stringold.py @ 6820:8ef481c7c3af legacy-trunk
Since this module is used as a fallback in case no built-in modules
have been configured, string.atof() should not fail when "import re"
fails (usually because pcre is not there).
This opens up a tiny security hole: *if* an attacker can make "import
re" fail, they can also make string.atof(arbitrary_string) evaluate
the arbitrary string. Nothing to keep me awake at night...
| author | Guido van Rossum <guido@python.org> |
|---|---|
| date | Wed, 10 Dec 1997 22:35:02 +0000 |
| parents | d790fe25e148 |
| children | b19cd4313126 |
line wrap: on
line diff
--- a/Lib/stringold.py Wed Dec 10 19:36:41 1997 +0000 +++ b/Lib/stringold.py Wed Dec 10 22:35:02 1997 +0000 @@ -203,7 +203,11 @@ def atof(str): global re if re is None: - import re + # Don't fail if re doesn't exist -- just skip the syntax check + try: + import re + except ImportError: + re = 0 sign = '' s = strip(str) if s and s[0] in '+-': @@ -212,10 +216,10 @@ if not s: raise ValueError, 'non-float argument to string.atof' while s[0] == '0' and len(s) > 1 and s[1] in digits: s = s[1:] - if not re.match('[0-9]*(\.[0-9]*)?([eE][-+]?[0-9]+)?$', s): + if re and not re.match('[0-9]*(\.[0-9]*)?([eE][-+]?[0-9]+)?$', s): raise ValueError, 'non-float argument to string.atof' try: - return float(eval(sign + s)) + return float(eval(sign + s, {})) except SyntaxError: raise ValueError, 'non-float argument to string.atof'