Merge pull request #115 from paulosgf/styleupdate

Fix vulnerable eval() on monopoly plugin
pyhoneybot · Jun 10, 2022 · 9265f0b · 9265f0b
2 parents d2b907d + e6041bb
commit 9265f0b
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/src/honeybot/plugins/downloaded/monopoly/main.py b/src/honeybot/plugins/downloaded/monopoly/main.py
@@ -320,7 +320,10 @@ def get_rent(asset, asset_owner, move_amount):
  print(num_util)
  calc_string = asset.rents[num_util] + " " + str(move_amount)
  print(calc_string)
- return eval(calc_string)
+ return eval(
+ calc_string, {"__builtins__": None},
+ {"str": str, "int": int, "float": float}
+ )
 
  elif isinstance(asset, Railroad):
  num_rail = len(