feat(confmanager): Added ZMS.input.exec.restrict#431
Conversation
|
@drfho & @OscarMeier As discussed earlier today I introduced a new conf property It preserves handling in |
cmeier76
changed the title
cmeier76
force-pushed
the
avoid-conf-calls-in-dt-exec
branch
2 times, most recently
from
274134a to
a8f1f87
Compare
Prevent usage of these keywords on standard.dt_exec or standard.get_env
cmeier76
force-pushed
the
avoid-conf-calls-in-dt-exec
branch
from
a8f1f87 to
e02b822
Compare
This limits the check to actual code execution.
cmeier76
force-pushed
the
avoid-conf-calls-in-dt-exec
branch
from
6b3fb9a to
bafe60e
Compare
There was a problem hiding this comment.
Hi, according to "Restricted Python" we may choose a similar term, because the approach has a similar goal: preventing code executions by defining restricted function names. Moreover there is a term "input" qualifying confproperties, dealing with user-entries.
Putting it together the terminology might be:
- ZMS.input.exec.restrict
- check_restricted_inputs(context, value, can_ignore)
The param 'can_ignore' is a doubled negation? ignore restriction vs. forcing the restriction? If the confprop ist not available, its restriction shall be forced, right? Why not give a default here, like check_restricted_inputs(context, value, force_restriction=False)
cmeier76
changed the title
drfho
left a comment
drfho
left a comment
There was a problem hiding this comment.
LGTM
Hint:
The new error may have devastating effects on the content stream. So the standard-template of the concerned object may need some exeption handling for giving a polite feedback ;-)
@drfho I would have expected the message and traceback from the raise exception - as seen in my tests: 
|
cmeier76
force-pushed
the
avoid-conf-calls-in-dt-exec
branch
from
558eeca to
36d1acc
Compare
2 participants
On discussing and reverting #430 (comment) we suggest these further actions - but we are unsure whether it has unintended consequences. What do you think...?! cc/ @OscarMeier