zopefoundation / RestrictedPython

A restricted execution environment for Python to run untrusted code.
http://restrictedpython.readthedocs.io/
Other
456 stars 38 forks source link

best approach to allow @/matmult? #268

Closed rawwerks closed 6 months ago

rawwerks commented 7 months ago

hi! i'm sorry if this isn't the right place to ask this question, but i couldn't find anywhere else that the cool RestrictedPython people hang out.

i'm using a python package that is basically a domain-specific language, and one of the features of the language is overwriting @ to have a specific definition.

after failing repeatedly to do a workaround where i overwrite @ with AST before getting the safe code, i think i need to find a way to allow ___matmult___ (or more accurately, allow the @ to be in the code)

what would be the recommended way to do this?

the simplest way i can think of is to fork the repo & change this line to allow the node to be visited. https://github.com/zopefoundation/RestrictedPython/blob/821ea97f20327d8e549a42517f9dfbe500903440/src/RestrictedPython/transformer.py#L770

for both safety and maintainability, i would prefer to avoid changing the source code if possible.

is there a more elegant way to tell restrictedpython that it needs to allow @ ? can i add a @ function to the safe_globals that just passes the symbol through?

to clarify once again - i don't need ___matmult___, i need restrictedpython to allow the @ so i can use the package-specific definition of the @ symbol.

icemac commented 7 months ago

@rawwerks You could create a PR where visit_MatMult calls return self.node_contents_visit(node) like the other binary operators. It is currently not allowed, because there was no use-case, yet, and we were not able to come up with example code for the tests: There seems to be no usage in plain Python.

rawwerks commented 7 months ago

thank you @icemac !

i finally found the 20 seconds required to make this PR.

icemac commented 6 months ago

Released in https://pypi.org/project/RestrictedPython/7.1/