security: safe_eval can only execute code from python 3.10

This commit is contained in:
Faraphel 2022-10-17 14:30:56 +02:00
parent 422c1de267
commit 7c746de01c

View file

@ -58,7 +58,7 @@ def safe_eval(template: "TemplateSafeEval", env: "Env" = None, macros: dict[str,
locals_ = {}
# convert the template to an ast expression
stmt: ast.stmt = ast.parse(template).body[0]
stmt: ast.stmt = ast.parse(template, feature_version=(3, 10)).body[0]
if not isinstance(stmt, ast.Expr):
raise SafeEvalException(_("ERROR_INVALID_AST_TYPE") % type(stmt).__name__)