CVE-2014-6633

@@ -1,3 +1,4 @@
+* Use literal_eval instead of safe_eval (CVE-2014-6633)
 * Prevent double underscore in safe_eval (CVE-2014-6633)
 * Add pre-validation on button
 * Model and Field access checked only if _check_access is set

@@ -7,9 +7,10 @@
 import logging
 from email.mime.text import MIMEText
 from email.header import Header
+from ast import literal_eval
 
 from ..model import ModelView, ModelSQL, fields
-from ..tools import safe_eval, get_smtp_server
+from ..tools import get_smtp_server
 from ..transaction import Transaction
 from ..pool import Pool
 from .. import backend
@@ -156,7 +157,7 @@ def _callback(cls, cron):
         pool = Pool()
         Config = pool.get('ir.configuration')
         try:
-            args = (cron.args or []) and safe_eval(cron.args)
+            args = (cron.args or []) and literal_eval(cron.args)
             Model = pool.get(cron.model)
             with Transaction().set_user(cron.user.id):
                 getattr(Model, cron.function)(*args)

@@ -2,10 +2,11 @@
 #this repository contains the full copyright notices and license terms.
 import datetime
 import warnings
+from ast import literal_eval
 
 from ..model import ModelView, ModelSQL, fields
 from ..cache import Cache
-from ..tools import safe_eval, datetime_strftime
+from ..tools import datetime_strftime
 from ..transaction import Transaction
 from ..pool import Pool
 from .time_locale import TIME_LOCALE
@@ -135,7 +136,7 @@ def check_grouping(cls, langs):
         '''
         for lang in langs:
             try:
-                grouping = safe_eval(lang.grouping)
+                grouping = literal_eval(lang.grouping)
                 for i in grouping:
                     if not isinstance(i, int):
                         raise
@@ -257,10 +258,10 @@ def _grouping_intervals(grouping):
 
         if monetary:
             thousands_sep = monetary.mon_thousands_sep
-            grouping = safe_eval(monetary.mon_grouping)
+            grouping = literal_eval(monetary.mon_grouping)
         else:
             thousands_sep = lang.thousands_sep
-            grouping = safe_eval(lang.grouping)
+            grouping = literal_eval(lang.grouping)
         if not grouping:
             return (s, 0)
         if s[-1] == ' ':

@@ -9,6 +9,8 @@
 import datetime
 from itertools import groupby, ifilter
 from operator import attrgetter
+from ast import literal_eval
+
 from sql import Literal
 from sql.conditionals import Coalesce
 from sql.aggregate import Count
@@ -21,7 +23,7 @@
 
 from ..model import ModelView, ModelSQL, fields
 from ..wizard import Wizard, StateView, Button, StateTransition
-from ..tools import safe_eval, grouped_slice
+from ..tools import grouped_slice
 from .. import backend
 from ..transaction import Transaction
 from ..cache import Cache
@@ -341,7 +343,7 @@ def _get_preferences(cls, user, context_only=False):
                 date = date.replace(i, j)
             res['locale'] = {
                 'date': date,
-                'grouping': safe_eval(user.language.grouping),
+                'grouping': literal_eval(user.language.grouping),
                 'decimal_point': user.language.decimal_point,
                 'thousands_sep': user.language.thousands_sep,
             }

@@ -8,12 +8,14 @@
 import encodings
 import uuid
 import datetime
+from ast import literal_eval
+
 from dateutil.relativedelta import relativedelta
 from sql.functions import Extract
 from sql.conditionals import Coalesce
 
 from trytond.model import ModelView, ModelSQL, fields
-from trytond.tools import reduce_ids, safe_eval
+from trytond.tools import reduce_ids
 from trytond.transaction import Transaction
 from trytond.pool import Pool
 from trytond.config import config
@@ -307,7 +309,7 @@ def get_childs(cls, uri, filter=None, cache=None):
                 if not Model:
                     return res
                 models = Model.search(
-                        safe_eval(collection.domain or "[]"))
+                    literal_eval(collection.domain))
                 for child in models:
                     if '/' in child.rec_name:
                         continue
@@ -759,7 +761,7 @@ def get_path(cls, attachments, name):
             model_name = collection.model.model
             Model = pool.get(model_name)
             ids = list(resources[model_name])
-            domain = safe_eval(collection.domain or '[]')
+            domain = literal_eval(collection.domain)
             domain = [domain, ('id', 'in', ids)]
             records = Model.search(domain)
             for record in records:

@@ -1,3 +1,4 @@
+* Prevent double underscore in safe_eval (CVE-2014-6633)
 * Add pre-validation on button
 * Model and Field access checked only if _check_access is set
 * Add check_access to RPC

@@ -64,7 +64,7 @@ def test0060safe_eval_builtin(self):
 
     def test0061safe_eval_getattr(self):
         'Attempt to get arround direct attr access'
-        self.assertRaises(NameError, safe_eval, "getattr(int, '__abs__')")
+        self.assertRaises(NameError, safe_eval, "getattr(int, 'real')")
 
     def test0062safe_eval_func_globals(self):
         'Attempt to access global enviroment where fun was defined'

@@ -369,8 +369,8 @@ def _compile_source(source):
 
 
 def safe_eval(source, data=None):
-    if '__subclasses__' in source:
-        raise ValueError('__subclasses__ not allowed')
+    if '__' in source:
+        raise ValueError('Double underscores not allowed')
 
     comp = _compile_source(source)
     return eval(comp, {'__builtins__': {