Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] Bunch of unsafe evals in code #196

Open
ColonelThirtyTwo opened this issue Mar 17, 2021 · 1 comment
Open

[BUG] Bunch of unsafe evals in code #196

ColonelThirtyTwo opened this issue Mar 17, 2021 · 1 comment

Comments

@ColonelThirtyTwo
Copy link

PSA to users: Don't load untrusted input with Sorcar activated.

Sorcar uses the Python eval function a lot, and in unsafe ways. Pretty much everything involving arrays uses it, because "arrays" in Sorcar are represented as strings that are eval'd when they need to be used, though that's not the usage of eval.

Example: in socket_base.py:

return self.set(eval("bpy.data.node_groups['" + self.id_data.name + "'].nodes['" + self.node.name + "']." + self.default_prop))

This is easily exploitable by altering the node or node tree name.

@ColonelThirtyTwo
Copy link
Author

Now that I think about it, the Python node makes sorcar unsafe by default, so the first sentence applies no matter what.

Still though, the use of eval is sloppy.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant