Problem
The property-introspection helper in d8s_python/python_data.py:224 (and the following few lines) builds and evals a string to read/call attributes:
string_to_eval_as_property = "python_object.{}".format(i)
eval_result = eval(string_to_eval_as_property)
...
eval(string_to_eval_as_function)
i comes from python_object.__dir__(), not external input, so this isn't exploitable today. Still worth removing the eval pattern since it's introspection over attribute names, which getattr handles directly.
Fix
eval_result = getattr(python_object, i)
if callable(eval_result):
try:
print(f"{i}: {eval_result()}")
except TypeError:
print(f"{i}: {eval_result}")
Problem
The property-introspection helper in
d8s_python/python_data.py:224(and the following few lines) builds and evals a string to read/call attributes:icomes frompython_object.__dir__(), not external input, so this isn't exploitable today. Still worth removing the eval pattern since it's introspection over attribute names, whichgetattrhandles directly.Fix