enthought / enthought/scimath

Odd behavior with units parsing

Open
#58 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
66
Forks
13
PR merge metrics
No merged PRs in 30d

Description

Units are being run through "eval" at some point, resulting in this:
```
In [70]: UnitScalar(1, units='min')
Out[70]: UnitScalar(1, units='')

In [71]: UnitScalar(1, units='__import__("os").system("ls -l /")')
total 45
drwxrwxr-x+ 73 root admin 2482 Jun 26 17:24 Applications
drwxr-xr-x+ 64 root wheel 2176 Aug 31 2016 Library
drwxr-xr-x@ 2 root wheel 68 Nov 9 2015 Network
drwxr-xr-x@ 4 root wheel 136 May 17 13:55 System
drwxr-xr-x 6 root admin 204 Nov 9 2015 Users
drwxrwxrwt@ 3 root admin 102 Jul 3 13:04 Volumes
drwxr-xr-x@ 39 root wheel 1326 May 17 13:55 bin
drwxrwxr-t@ 2 root admin 68 Nov 9 2015 cores
dr-xr-xr-x 3 root wheel 4210 Jul 3 10:08 dev
lrwxr-xr-x@ 1 root wheel 11 Nov 9 2015 etc -> private/etc
dr-xr-xr-x 2 root wheel 1 Jul 3 10:08 home
-rw-r--r--@ 1 root wheel 313 Aug 22 2015 installer.failurerequests
dr-xr-xr-x 2 root wheel 1 Jul 3 10:08 net
drwxrwxr-x@ 6 root wheel 204 Sep 14 2016 opt
drwxr-xr-x@ 6 root wheel 204 Aug 31 2016 private
drwxr-xr-x@ 59 root wheel 2006 May 17 13:55 sbin
lrwxr-xr-x@ 1 root wheel 11 Nov 9 2015 tmp -> private/tmp
drwxr-xr-x@ 13 root wheel 442 Nov 12 2015 usr
lrwxr-xr-x@ 1 root wheel 11 Nov 9 2015 var -> private/var
Out[71]: UnitScalar(1, units='0')
```
Basically, right now unit labels should not be accepted from an untrusted source.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.