search

dsa-ou / allowed

Check if a program only uses a subset of the Python language.
https://dsa-ou.github.io/allowed/
BSD 3-Clause "New" or "Revised" License
10 stars 6 forks source link

string and tuple methods are allowed #37

Closed mwermelinger closed 9 months ago

mwermelinger commented 9 months ago

@densnow found that no str or tuple method is flagged as disallowed and suggests to add to the configuration something like str: [] to explicitly say that no string method is allowed.

If it works, it's a good quick fix, and makes explicit that nothing is allowed. Would also have to add all other built-in types (bytes, whatever). For library and user-defined types, what is allowed is restricted by the import configuration.

Ideally, this should be fixed well before TMA02 submission.

mwermelinger commented 9 months ago

Effort is medium because it also requires improving tests.

densnow commented 9 months ago

I did a (very) quick test by adding str: [] to unit 4 in the M269 config file. It does seem to be a viable quick fix and should do the job. I also ran the test script and no strange behaviors were present.

I am guessing in the long term it could be best to change the logic of allowedto flag methods not explicitly mentioned in the config. It is nice to have the config file only include things that are allowed rather than the other way around :smile:

The common builtins (not already in the M269 config) that have methods seem to be int, float complex, tuple, range, str, bytes, bytearray. Hopefully that covers everything we need for now?

mwermelinger commented 9 months ago

Thanks. Yes, it would be best that "if it's not explicitly allowed, it's disallowed", but then we need to parse any user classes and import statements to check that code that calls them is allowed.