Work in progress to sandbox the uses of eval in LMS.

common/lib/capa/capa/capa_problem.py

@@ -22,7 +22,6 @@ import numpy
 import os
 import random
 import re
-import scipy
 import struct
 import sys
 
@@ -30,6 +29,7 @@ from lxml import etree
 from xml.sax.saxutils import unescape
 from copy import deepcopy
 
+<<<<<<< HEAD
 import chem
 import chem.miller
 import chem.chemcalc
@@ -38,8 +38,9 @@ import verifiers
 import verifiers.draganddrop
 
 import calc
+=======
+>>>>>>> Work in progress to sandbox the uses of eval in LMS.
 from .correctmap import CorrectMap
-import eia
 import inputtypes
 import customrender
 from .util import contextualize_text, convert_files_to_filenames
@@ -48,6 +49,8 @@ import xqueue_interface
 # to be replaced with auto-registering
 import responsetypes
 
+from codejail.safe_exec import safe_exec
+
 # dict of tagname, Response Class -- this should come from auto-registering
 response_tag_dict = dict([(x.response_tag, x) for x in responsetypes.__all__])
 
@@ -63,6 +66,7 @@ html_transforms = {'problem': {'tag': 'div'},
                    "math": {'tag': 'span'},
                    }
 
+<<<<<<< HEAD
 global_context = {'random': random,
                   'numpy': numpy,
                   'math': math,
@@ -73,6 +77,20 @@ global_context = {'random': random,
                   'chemtools': chem.chemtools,
                   'miller': chem.miller,
                   'draganddrop': verifiers.draganddrop}
+=======
+safe_exec_assumed_imports = [
+    "random",
+    "numpy",
+    "math",
+    "scipy",
+    "calc",
+    "eia",
+    ("chemcalc", "chem.chemcalc"),
+    ("chemtools", "chem.chemtools"),
+    ("miller", "chem.miller"),
+    ("draganddrop", "verifiers.draganddrop"),
+]
+>>>>>>> Work in progress to sandbox the uses of eval in LMS.
 
 # These should be removed from HTML output, including all subelements
 html_problem_semantics = ["codeparam", "responseparam", "answer", "script", "hintgroup", "openendedparam", "openendedrubric"]
@@ -144,7 +162,7 @@ class LoncapaProblem(object):
         self._process_includes()
 
         # construct script processor context (eg for customresponse problems)
-        self.context = self._extract_context(self.tree, seed=self.seed)
+        self.context = self._extract_context(self.tree)
 
         # Pre-parse the XML tree: modifies it to add ID's and perform some in-place
         # transformations.  This also creates the dict (self.responders) of Response
@@ -451,7 +469,7 @@ class LoncapaProblem(object):
 
         return path
 
-    def _extract_context(self, tree, seed=struct.unpack('i', os.urandom(4))[0]):  # private
+    def _extract_context(self, tree):
         '''
         Extract content of <script>...</script> from the problem.xml file, and exec it in the
         context of this problem.  Provides ability to randomize problems, and also set
@@ -460,14 +478,18 @@ class LoncapaProblem(object):
         Problem XML goes to Python execution context. Runs everything in script tags.
         '''
         random.seed(self.seed)
-        # save global context in here also
-        context = {'global_context': global_context}
-
-        # initialize context to have stuff in global_context
-        context.update(global_context)
 
+        # TODO: REMOVE THIS COMMENTED OUT CODE.
+        ## save global context in here also
+        #context = {'global_context': global_context}
+        #
+        ## initialize context to have stuff in global_context
+        #context.update(global_context)
+        #
         # put globals there also
-        context['__builtins__'] = globals()['__builtins__']
+        #context['__builtins__'] = globals()['__builtins__']
+
+        context = {}
 
         # pass instance of LoncapaProblem in
         context['the_lcp'] = self
@@ -501,7 +523,7 @@ class LoncapaProblem(object):
             context['script_code'] += code
             try:
                 # use "context" for global context; thus defs in code are global within code
-                exec code in context, context
+                safe_exec(code, context, future_division=True, assumed_imports=safe_exec_assumed_imports)
             except Exception as err:
                 log.exception("Error while execing script code: " + code)
                 msg = "Error while executing script code: %s" % str(err).replace('<', '&lt;')