Skip to content

Commit 01e839c

Browse files
committed
Remove 'exec' function to make processing secure.
Signed-off-by: Bennati, Stefano <stefano.bennati@here.com>
1 parent 6744983 commit 01e839c

File tree

1 file changed

+7
-9
lines changed

1 file changed

+7
-9
lines changed

src/python_inspector/resolution.py

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -303,15 +303,13 @@ def get_requirements_from_python_manifest(
303303
# Do not raise exception here as we may have a setup.py that does not
304304
# have any dependencies.
305305
with (open(setup_py_location)) as sf:
306-
install_requires = []
307-
parameters = re.sub(
308-
r"\s", "", re.findall(r"install_requires[\s]*=[\s]*\[[^\]]*\]", sf.read())[0]
309-
)
310-
exec(parameters) # update 'install_requires' from setup.py
311-
if install_requires != []:
312-
raise Exception(
313-
f"Unable to collect setup.py dependencies securely: {setup_py_location}"
314-
)
306+
match = re.search(r"install_requires[\s]*=[\s]*\[([^\]]*)\]", sf.read())
307+
if match is not None:
308+
install_requires = re.sub(r"\s", "", match.group(1))
309+
if install_requires != "":
310+
raise Exception(
311+
f"Unable to collect setup.py dependencies securely: {setup_py_location}"
312+
)
315313

316314

317315
DEFAULT_ENVIRONMENT = utils_pypi.Environment.from_pyver_and_os(

0 commit comments

Comments
 (0)