Odd behavior with units parsing
- Dominant language
- Python
- Stars
- 66
- Forks
- 13
- PR merge metrics
- No merged PRs in 30d
Description
Units are being run through "eval" at some point, resulting in this:
```
In [70]: UnitScalar(1, units='min')
Out[70]: UnitScalar(1, units='')
In [71]: UnitScalar(1, units='__import__("os").system("ls -l /")')
total 45
drwxrwxr-x+ 73 root admin 2482 Jun 26 17:24 Applications
drwxr-xr-x+ 64 root wheel 2176 Aug 31 2016 Library
drwxr-xr-x@ 2 root wheel 68 Nov 9 2015 Network
drwxr-xr-x@ 4 root wheel 136 May 17 13:55 System
drwxr-xr-x 6 root admin 204 Nov 9 2015 Users
drwxrwxrwt@ 3 root admin 102 Jul 3 13:04 Volumes
drwxr-xr-x@ 39 root wheel 1326 May 17 13:55 bin
drwxrwxr-t@ 2 root admin 68 Nov 9 2015 cores
dr-xr-xr-x 3 root wheel 4210 Jul 3 10:08 dev
lrwxr-xr-x@ 1 root wheel 11 Nov 9 2015 etc -> private/etc
dr-xr-xr-x 2 root wheel 1 Jul 3 10:08 home
-rw-r--r--@ 1 root wheel 313 Aug 22 2015 installer.failurerequests
dr-xr-xr-x 2 root wheel 1 Jul 3 10:08 net
drwxrwxr-x@ 6 root wheel 204 Sep 14 2016 opt
drwxr-xr-x@ 6 root wheel 204 Aug 31 2016 private
drwxr-xr-x@ 59 root wheel 2006 May 17 13:55 sbin
lrwxr-xr-x@ 1 root wheel 11 Nov 9 2015 tmp -> private/tmp
drwxr-xr-x@ 13 root wheel 442 Nov 12 2015 usr
lrwxr-xr-x@ 1 root wheel 11 Nov 9 2015 var -> private/var
Out[71]: UnitScalar(1, units='0')
```
Basically, right now unit labels should not be accepted from an untrusted source.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.