Skip to content

Commit a8bf44d

Browse files
authored
bpo-41944: No longer call eval() on content received via HTTP in the UnicodeNames tests (GH-22575)
Similarly to GH-22566, those tests called eval() on content received via HTTP in test_named_sequences_full. This likely isn't exploitable because unicodedata.lookup(seqname) is called before self.checkletter(seqname, None) - thus any string which isn't a valid unicode character name wouldn't ever reach the checkletter method. Still, it's probably better to be safe than sorry.
1 parent 2ef5caa commit a8bf44d

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

Lib/test/test_ucn.py

+2-1
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
88
"""#"
99

10+
import ast
1011
import unittest
1112
import unicodedata
1213

@@ -24,7 +25,7 @@ def checkletter(self, name, code):
2425
# Helper that put all \N escapes inside eval'd raw strings,
2526
# to make sure this script runs even if the compiler
2627
# chokes on \N escapes
27-
res = eval(r'"\N{%s}"' % name)
28+
res = ast.literal_eval(r'"\N{%s}"' % name)
2829
self.assertEqual(res, code)
2930
return res
3031

0 commit comments

Comments
 (0)