Changes between Version 8 and Version 9 of Simplistic_json_rpc-dispatcher

Timestamp:

Aug 6, 2011, 5:24:08 AM (13 years ago)

Author:

anonymous

Comment:

--

Simplistic_json_rpc-dispatcher

@@ -1 @@
-== A simplistic json-rpc dispatcher-function for Django in 15 lines ==
+= A simplistic json-rpc dispatcher-function for Django in 15 lines =
 
+== Security warning ==
+This code contains a security issue! It uses eval() on the json data coming from the client without first cleaning it. This makes it possible for an attacker to run arbitrary code on the server.
+
+== The code ==
 {{{
   ### myproj/myapp/views.py
@@ -13 +17 @@
       sub_eval = str(rpc_inputs['method']) + '(rpc_inputs["params"])'
       if rpc_inputs['method'] in jsonrpc_methods:
+         # WARNING: Executing eval() on untrusted data
          result = eval(sub_eval)
          json_retur = json.dumps({'result': result['result'], 'error': result['error'], 'id': rpc_inputs['id']})