diff --git a/assets/language/en.json b/assets/language/en.json index ea8d2d8..20d3734 100644 --- a/assets/language/en.json +++ b/assets/language/en.json @@ -100,6 +100,7 @@ "SAFE_EVAL_ERROR": "Safe eval error", "TEMPLATE_USED": "Template used", "MORE_IN_ERROR_LOG": "More information in the error.log file", - "COPY_FUNCTION_FORBIDDEN": "Copying functions is forbidden" + "COPY_FUNCTION_FORBIDDEN": "Copying functions is forbidden", + "GET_METHOD_FORBIDDEN": "Using getattr on a method is forbidden" } } \ No newline at end of file diff --git a/assets/language/fr.json b/assets/language/fr.json index 4b3a919..4e44700 100644 --- a/assets/language/fr.json +++ b/assets/language/fr.json @@ -101,6 +101,7 @@ "SAFE_EVAL_ERROR": "Erreur lors d'un safe eval", "TEMPLATE_USED": "Modèle utilisé", "MORE_IN_ERROR_LOG": "Plus d'information dans le fichier error.log", - "COPY_FUNCTION_FORBIDDEN": "Impossible de copier une fonction" + "COPY_FUNCTION_FORBIDDEN": "Impossible de copier une fonction", + "GET_METHOD_FORBIDDEN": "Impossible d'utiliser getattr sur une méthode" } } \ No newline at end of file diff --git a/source/safe_eval/safe_function.py b/source/safe_eval/safe_function.py index 242a78c..897e730 100644 --- a/source/safe_eval/safe_function.py +++ b/source/safe_eval/safe_function.py @@ -37,7 +37,9 @@ class safe_function: Same as normal getattr, but magic attribute are banned """ if "__" in name: raise Exception(_("MAGIC_METHOD_FORBIDDEN", ' : "', name, '"')) - return getattr(obj, name, default) + attr = getattr(obj, name, default) + if callable(attr): raise Exception(_("GET_METHOD_FORBIDDEN", ' : "', name, '"')) + return attr @staticmethod def type(obj: any):