[BUG] Bunch of unsafe evals in code
Aperta
- Lingua principale
- Python
- Stelle
- 1.2k
- Fork
- 112
- Metriche di merge delle PR
- Nessuna PR unita negli ultimi 30g
Descrizione
PSA to users: Don't load untrusted input with Sorcar activated.
Sorcar uses the Python `eval` function a lot, and in unsafe ways. Pretty much everything involving arrays uses it, because "arrays" in Sorcar are represented as strings that are `eval`'d when they need to be used, though that's not the usage of eval.
Example: in `socket_base.py`:
```
return self.set(eval("bpy.data.node_groups['" + self.id_data.name + "'].nodes['" + self.node.name + "']." + self.default_prop))
```
This is easily exploitable by altering the node or node tree name.
Guida per i contributori
Nessuna guida per i contributori indicizzata per questo repository
Valutazione
Questa issue non è ancora stata valutata.