CopyBot/Red-DiscordBot
1
0
Fork 0
mirror of https://github.com/Cog-Creators/Red-DiscordBot.git synced 2025-11-08 12:18:54 -05:00
Code Issues Packages Projects Releases Wiki Activity

Removed eval from CCs arguments, laxer checks

Browse Source 
Previous checks were preventing attributes containing underscores from being used
This commit is contained in:
Twentysix 2016-07-24 14:06:42 +02:00
parent ca8285949d
commit 18d5415db8
1 changed files with 12 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
cogs/customcom.py
View File

@ -2,7 +2,6 @@ import discord
from discord.ext import commands from discord.ext import commands
from .utils.dataIO import fileIO from .utils.dataIO import fileIO
from .utils import checks from .utils import checks
from string import ascii_letters
from __main__ import user_allowed, send_cmd_help from __main__ import user_allowed, send_cmd_help
import os import os
import re import re
@ -143,27 +142,24 @@ class CustomCommands:
def transform_parameter(self, result, message): def transform_parameter(self, result, message):
""" """
This should be bomb proof. I eval only the base object, and only For security reasons only specific objects are allowed
if it's present in the allowed list. Only one depth level is allowed. Internals are ignored
Only letters and dots are allowed.
""" """
raw_result = "{" + result + "}" raw_result = "{" + result + "}"
author = message.author objects = {
channel = message.channel "message" : message,
server = author.server "author" : message.author,
valid_chars = ascii_letters + "." "channel" : message.channel,
allowed = ("message", "author", "server", "channel") "server" : message.server
for char in result: }
if char not in valid_chars: if result in objects:
return raw_result return str(objects[result])
if result in allowed:
return str(eval(result))
try: try:
first, second = result.split(".") first, second = result.split(".")
except ValueError: except ValueError:
return raw_result return raw_result
if first in allowed: if first in objects and not second.startswith("_"):
first = eval(first) first = objects[first]
else: else:
return raw_result return raw_result
return str(getattr(first, second, raw_result)) return str(getattr(first, second, raw_result))