comparison mercurial/wireprotoframing.py @ 37476:e9dea82ea1f3

wireproto: convert python literal to object without using unsafe eval()

Follows up cc5a040fe150.

At this point, I don't think we need a real eval(). If we want to support
a set literal, maybe we can vendor ast.literal_eval(), which is relatively
simple function.

37475:152f1b47e0ad

    return frame

def makeframefromhumanstring(s):
    """Create a frame from a human readable string

    DANGER: NOT SAFE TO USE WITH UNTRUSTED INPUT BECAUSE OF POTENTIAL
    eval() USAGE. DO NOT USE IN CORE.

    Strings have the form:

        <request-id> <stream-id> <stream-flags> <type> <flags> <payload>

    This can be used by user-facing applications and tests for creating

    named constant.

    Flags can be delimited by `|` to bitwise OR them together.

    If the payload begins with ``cbor:``, the following string will be
    evaluated as Python code and the resulting object will be fed into
    a CBOR encoder. Otherwise, the payload is interpreted as a Python
    byte string literal.
    """
    fields = s.split(b' ', 5)
    requestid, streamid, streamflags, frametype, frameflags, payload = fields

            finalflags |= validflags[flag]
        else:
            finalflags |= int(flag)

    if payload.startswith(b'cbor:'):
        payload = cbor.dumps(stringutil.evalpython(payload[5:]), canonical=True)

    else:
        payload = stringutil.unescapestr(payload)

    return makeframe(requestid=requestid, streamid=streamid,

37476:e9dea82ea1f3

    return frame

def makeframefromhumanstring(s):
    """Create a frame from a human readable string

    Strings have the form:

        <request-id> <stream-id> <stream-flags> <type> <flags> <payload>

    This can be used by user-facing applications and tests for creating

    named constant.

    Flags can be delimited by `|` to bitwise OR them together.

    If the payload begins with ``cbor:``, the following string will be
    evaluated as Python literal and the resulting object will be fed into
    a CBOR encoder. Otherwise, the payload is interpreted as a Python
    byte string literal.
    """
    fields = s.split(b' ', 5)
    requestid, streamid, streamflags, frametype, frameflags, payload = fields

            finalflags |= validflags[flag]
        else:
            finalflags |= int(flag)

    if payload.startswith(b'cbor:'):
        payload = cbor.dumps(stringutil.evalpythonliteral(payload[5:]),
                             canonical=True)

    else:
        payload = stringutil.unescapestr(payload)

    return makeframe(requestid=requestid, streamid=streamid,