ó
,òQc           @   sß   d  Z  d d l Z d d l m Z d d l m Z d d l m Z m Z m	 Z	 d d l m
 Z
 m Z d d l m Z m Z m Z d d l m Z d	 e f d
 „  ƒ  YZ d e f d „  ƒ  YZ d e f d „  ƒ  YZ d „  Z d S(   sÐ   
    jinja2.testsuite.security
    ~~~~~~~~~~~~~~~~~~~~~~~~~

    Checks the sandbox and other security features.

    :copyright: (c) 2010 by the Jinja Team.
    :license: BSD, see LICENSE for more details.
iÿÿÿÿN(   t   JinjaTestCase(   t   Environment(   t   SandboxedEnvironmentt   ImmutableSandboxedEnvironmentt   unsafe(   t   Markupt   escape(   t   SecurityErrort   TemplateSyntaxErrort   TemplateRuntimeError(   t	   text_typet   PrivateStuffc           B   s)   e  Z d  „  Z e d „  ƒ Z d „  Z RS(   c         C   s   d S(   Ni   (    (   t   self(    (    s=   /usr/lib/python2.7/site-packages/jinja2/testsuite/security.pyt   bar   s    c         C   s   d S(   Ni*   (    (   R   (    (    s=   /usr/lib/python2.7/site-packages/jinja2/testsuite/security.pyt   foo   s    c         C   s   d S(   NR   (    (   R   (    (    s=   /usr/lib/python2.7/site-packages/jinja2/testsuite/security.pyt   __repr__!   s    (   t   __name__t
   __module__R   R   R   R   (    (    (    s=   /usr/lib/python2.7/site-packages/jinja2/testsuite/security.pyR      s   	t   PublicStuffc           B   s#   e  Z d  „  Z d „  Z d „  Z RS(   c         C   s   d S(   Ni   (    (   R   (    (    s=   /usr/lib/python2.7/site-packages/jinja2/testsuite/security.pyt   <lambda>&   s    c         C   s   d S(   Ni*   (    (   R   (    (    s=   /usr/lib/python2.7/site-packages/jinja2/testsuite/security.pyR   '   s    c         C   s   d S(   NR   (    (   R   (    (    s=   /usr/lib/python2.7/site-packages/jinja2/testsuite/security.pyR   )   s    (   R   R   R   t   _fooR   (    (    (    s=   /usr/lib/python2.7/site-packages/jinja2/testsuite/security.pyR   %   s   		t   SandboxTestCasec           B   sP   e  Z d  „  Z d „  Z d „  Z d „  Z d „  Z d „  Z d „  Z d „  Z	 RS(   c         C   s  t  ƒ  } |  j t | j d ƒ j d t ƒ  ƒ|  j | j d ƒ j d t ƒ  ƒ d ƒ |  j t | j d ƒ j d t ƒ  ƒ|  j | j d ƒ j d t ƒ  ƒ d ƒ |  j | j d ƒ j d d ƒ d ƒ |  j | j d	 ƒ j d d
 „  ƒ d ƒ |  j t | j d ƒ j d d ƒd  S(   Ns   {{ foo.foo() }}R   s   {{ foo.bar() }}t   23s   {{ foo._foo() }}s   {{ foo.__class__ }}i*   t    s   {{ foo.func_code }}c           S   s   d  S(   N(   t   None(    (    (    s=   /usr/lib/python2.7/site-packages/jinja2/testsuite/security.pyR   9   s    s$   {{ foo.__class__.__subclasses__() }}(   R   t   assert_raisesR   t   from_stringt   renderR   t   assert_equalR   (   R   t   env(    (    s=   /usr/lib/python2.7/site-packages/jinja2/testsuite/security.pyt   test_unsafe/   s    	
(
(%(c         C   sE   t  ƒ  } |  j t | j d ƒ j ƒ |  j t | j d ƒ j ƒ d  S(   Ns   {{ [].append(23) }}s   {{ {1:2}.clear() }}(   R   R   R   R   R   (   R   R   (    (    s=   /usr/lib/python2.7/site-packages/jinja2/testsuite/security.pyt   test_immutable_environment>   s
    	c         C   s9   t  ƒ  } |  j t | j d ƒ |  j t | j d ƒ d  S(   Ns.   {% for item.attribute in seq %}...{% endfor %}s,   {% for foo, bar.baz in seq %}...{% endfor %}(   R   R   R   R   (   R   R   (    (    s=   /usr/lib/python2.7/site-packages/jinja2/testsuite/security.pyt   test_restrictedE   s
    	c         C   s8   d } t  d ƒ } t  d ƒ } d t f d „  ƒ  Y} d  S(   Ns?   <script type="application/x-some-script">alert("foo");</script>s   <em>username</em>R   t   Fooc           B   s   e  Z d  „  Z d „  Z RS(   c         S   s   d S(   Ns   <em>awesome</em>(    (   R   (    (    s=   /usr/lib/python2.7/site-packages/jinja2/testsuite/security.pyt   __html__b   s    c         S   s   d S(   Nt   awesome(    (   R   (    (    s=   /usr/lib/python2.7/site-packages/jinja2/testsuite/security.pyt   __unicode__d   s    (   R   R   R"   R$   (    (    (    s=   /usr/lib/python2.7/site-packages/jinja2/testsuite/security.pyR!   a   s   	(   R   t   object(   R   R   t   safet   xR!   (    (    s=   /usr/lib/python2.7/site-packages/jinja2/testsuite/security.pyt   test_markup_operationsL   s
    c         C   s(   t  d t ƒ } | j d ƒ } d } d  S(   Nt
   autoescapesf   {% macro say_hello(name) %}<p>Hello {{ name }}!</p>{% endmacro %}{{ say_hello("<blink>foo</blink>") }}s,   <p>Hello &lt;blink&gt;foo&lt;/blink&gt;!</p>(   R   t   TrueR   (   R   R   t   tt   escaped_out(    (    s=   /usr/lib/python2.7/site-packages/jinja2/testsuite/security.pyt   test_template_datao   s    c         C   s5   t  ƒ  } | j d ƒ } |  j t | j d t ƒd  S(   Ns"   {{ cls|attr("__subclasses__")() }}t   cls(   R   R   R   R   R   t   int(   R   R   t   tmpl(    (    s=   /usr/lib/python2.7/site-packages/jinja2/testsuite/security.pyt   test_attr_filter{   s    	c         C   sÈ   d „  } x¸ d i  d f d i d d 6d f f D]‘ \ } } } t  ƒ  } | | j d <| j d	 | ƒ } t d g ƒ | _ | j d	 | ƒ } y | j | ƒ Wn t k
 r² } q/ X|  j d
 ƒ q/ Wd  S(   Nc         S   s   t  d ƒ ‚ d  S(   Ns   that operator so does not work(   R	   (   t   leftt   right(    (    s=   /usr/lib/python2.7/site-packages/jinja2/testsuite/security.pyt
   disable_op   s    s   1 + 2t   3s   a + 2i   t   at   4t   +s   {{ %s }}s   expected runtime error(   R   t   binop_tableR   t	   frozensett   intercepted_binopsR   R	   t   fail(   R   R4   t   exprt   ctxt   rvR   R+   t   e(    (    s=   /usr/lib/python2.7/site-packages/jinja2/testsuite/security.pyt!   test_binary_operator_intercepting€   s    	5	c         C   sÈ   d „  } x¸ d i  d f d i d d 6d f f D]‘ \ } } } t  ƒ  } | | j d <| j d | ƒ } t d g ƒ | _ | j d | ƒ } y | j | ƒ Wn t k
 r² } q/ X|  j d	 ƒ q/ Wd  S(
   Nc         S   s   t  d ƒ ‚ d  S(   Ns   that operator so does not work(   R	   (   t   arg(    (    s=   /usr/lib/python2.7/site-packages/jinja2/testsuite/security.pyR4   ’   s    s   -1s   -ai   R6   s   -2t   -s   {{ %s }}s   expected runtime error(   R   t
   unop_tableR   R:   t   intercepted_unopsR   R	   R<   (   R   R4   R=   R>   R?   R   R+   R@   (    (    s=   /usr/lib/python2.7/site-packages/jinja2/testsuite/security.pyt    test_unary_operator_intercepting‘   s    	5	(
   R   R   R   R   R    R(   R-   R1   RA   RF   (    (    (    s=   /usr/lib/python2.7/site-packages/jinja2/testsuite/security.pyR   -   s   				#			c          C   s&   t  j ƒ  }  |  j t  j t ƒ ƒ |  S(   N(   t   unittestt	   TestSuitet   addTestt	   makeSuiteR   (   t   suite(    (    s=   /usr/lib/python2.7/site-packages/jinja2/testsuite/security.pyRK   £   s    (   t   __doc__RG   t   jinja2.testsuiteR    t   jinja2R   t   jinja2.sandboxR   R   R   R   R   t   jinja2.exceptionsR   R   R	   t   jinja2._compatR
   R%   R   R   R   RK   (    (    (    s=   /usr/lib/python2.7/site-packages/jinja2/testsuite/security.pyt   <module>
   s   v