Mercurial > p > roundup > code
annotate roundup/anypy/findargspec.py @ 8365:4ac0bbb3e440
bug(security): CVE-2025-53865 - XSS bug
Extensive fixes in devel, responsive templates known to be
exploitable.
Similar constructs in classic and minimal templates not known
to be exploitable, but changed anyway.
doc/upgrading.txt:
Reformat to 66 characters.
Update with assigned CVE number.
Add section on fixing tal:replace with unsafe data.
Document analysis and assumptions in comment in file.
doc/security.txt:
Update with CVE number.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Fri, 11 Jul 2025 19:30:27 -0400 |
| parents | c588e64718fc |
| children |
| rev | line source |
|---|---|
|
5269
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
1 ''' Wrapper for getargspec to support other callables and python 3 support |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
2 |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
3 In python 3 just uses getfullargspec which handles regular functions |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
4 and classes with __call__ methods. |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
5 ''' |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
6 |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
7 try: |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
8 # Python 3+ |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
9 from inspect import getfullargspec as getargspec |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
10 findargspec = getargspec |
|
6021
c588e64718fc
flake8 fixes. use except ImportError; use callable() not hasattr(x, '__call__')
John Rouillard <rouilj@ieee.org>
parents:
5269
diff
changeset
|
11 except ImportError: |
|
5269
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
12 # Python 2.5-2.7 modified from https://bugs.python.org/issue20828 |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
13 import inspect |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
14 |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
15 def findargspec(fn): |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
16 if inspect.isfunction(fn) or inspect.ismethod(fn): |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
17 inspectable = fn |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
18 elif inspect.isclass(fn): |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
19 inspectable = fn.__init__ |
|
6021
c588e64718fc
flake8 fixes. use except ImportError; use callable() not hasattr(x, '__call__')
John Rouillard <rouilj@ieee.org>
parents:
5269
diff
changeset
|
20 elif callable(fn): |
|
5269
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
21 inspectable = fn.__call__ |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
22 else: |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
23 inspectable = fn |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
24 |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
25 try: |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
26 return inspect.getargspec(inspectable) |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
27 except TypeError: |
|
c94fd717e28c
Fix http://issues.roundup-tracker.org/issue2550952 make __call__
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
28 raise |
