Python 沙箱逃逸 ¶

dbgprint = sys.stderr.write

class Traversal():
    def __init__(self, node):
        self.tisiv(node)

    depth = -1
    def tisiv(self, nodes):
        if not isinstance(nodes, list):
            nodes = [nodes]
        self.depth += 1
        for node in nodes:
            func = getattr(self, 'tisiv_' + node.__class__.__name__, None)
            if func:
                dbgprint(" "*self.depth + "tisiv"[::-1] +"\t"+ node.__class__.__name__+"\n")
                return func(node)
            else:
                if not isinstance(node, ast.expr):
                    raise Exception("not allowed "+str(node))
        self.depth -= 1

    def tisiv_Call(self, node):
        raise Exception("not allowed")
        self.tisiv(node.func)
        self.tisiv(node.args)
        self.tisiv(node.keywords)

    def tisiv_Attribute(self, node):
        raise Exception("not allowed")
        self.tisiv(node.value)
        self.tisiv(node.attr)
        self.tisiv(node.ctx)

    def tisiv_Import(self, node):
        raise Exception("not allowed")

    def tisiv_Module(self, node):
        self.tisiv(node.body)

    def tisiv_BoolOp(self, node):
        self.tisiv(node.values)

    def tisiv_BinOp(self, node):
        self.tisiv(node.left)
        self.tisiv(node.right)

    def tisiv_UnaryOp(self, node):
        self.tisiv(node.operand)

    def tisiv_Lambda(self, node):
        self.tisiv(node.body)
        self.tisiv(node.args)

    def tisiv_IfExp(self, node):
        self.tisiv(node.test)
        self.tisiv(node.body)
        self.tisiv(node.orelse)

    def tisiv_Dict(self, node):
        self.tisiv(node.keys)
        self.tisiv(node.values)

    def tisiv_Set(self, node):
        self.tisiv(node.elts)

    def tisiv_ListComp(self, node):
        self.tisiv(node.elt)
        self.tisiv(node.generators)

    def tisiv_SetComp(self, node):
        self.tisiv(node.elt)
        self.tisiv(node.generators)

    def tisiv_DictComp(self, node):
        self.tisiv(node.key)
        self.tisiv(node.value)
        self.tisiv(node.generators)

    def tisiv_GeneratorExp(self, node):
        self.tisiv(node.elt)
        self.tisiv(node.generators)

    def tisiv_Yield(self, node):
        self.tisiv(node.value)

    def tisiv_Compare(self, node):
        self.tisiv(node.left)
        self.tisiv(node.comparators)

    def tisiv_Repr(self, node):
        self.tisiv(node.value)

    def tisiv_Subscript(self, node):
        self.tisiv(node.value)
        self.tisiv(node.slice)

    def tisiv_List(self, node):
        self.tisiv(node.elts)

    def tisiv_Tuple(self, node):
        self.tisiv(node.elts)

    def tisiv_Expr(self, node):
        self.tisiv(node.value)

    def tisiv_JoinedStr(self, node):
        self.tisiv(node.values)

    def tisiv_NameConstant(self, node):
        pass

Traversal(ast.parse(c))

def check(node):
    if isinstance(node, list):
        return all([check(n) for n in node])
    else:
        attributes = {
            'BoolOp': ['values'],
            'BinOp': ['left', 'right'],
            'UnaryOp': ['operand'],
            'Lambda': ['body'],
            'IfExp': ['test', 'body', 'orelse'],
            'Dict': ['keys', 'values'],
            'Set': ['elts'],
            'ListComp': ['elt', 'generators'],
            'SetComp': ['elt', 'generators'],
            'DictComp': ['key', 'value', 'generators'],
            'GeneratorExp': ['elt', 'generators'],
            'Yield': ['value'],
            'Compare': ['left', 'comparators'],
            'Call': False, # call is not permitted
            'Repr': ['value'],
            'Num': True,
            'Str': True,
            'Attribute': False, # attribute is also not permitted
            'Subscript': ['value'],
            'Name': True,
            'List': ['elts'],
            'Tuple': ['elts'],
            'Expr': ['value'], # root node 
            'comprehension': ['target', 'iter', 'ifs'],
        }

        for k, v in attributes.items():
            if hasattr(ast, k) and isinstance(node, getattr(ast, k)):
                if isinstance(v, bool):
                    return v
                return all([check(getattr(node, attr)) for attr in v])

if __name__ == '__main__':
    expr = sys.stdin.readline()
    body = ast.parse(expr).body

class MasterMetaClass(type):   
    def __new__(cls, class_name, class_parents, class_attr):
        def getFlag(self):
            print('Here you go, my master')
            with open('flag') as f:
                print(f.read())
        class_attr[getFlag.__name__] = getFlag
        attrs = ((name, value) for name, value in class_attr.items() if not name.startswith('__'))
        class_attr = dict(('IWant'+name.upper()+'Plz', value) for name, value in attrs)
        newclass = super().__new__(cls, class_name, class_parents, class_attr)
        return newclass
    def __init__(*argv):
        print('Bad guy! No Flag !!')
        raise 'Illegal'

class BalsnMetaClass(type):
    def getFlag(self):
        print('You\'re not Master! No Flag !!')

    def __new__(cls, class_name, class_parents, class_attr):
        newclass = super().__new__(cls, class_name, class_parents, class_attr)
        setattr(newclass, cls.getFlag.__name__, cls.getFlag)
        return newclass

def secure_vars(s):
    attrs = {name:value for name, value in vars(s).items() if not name.startswith('__')}
    return attrs

safe_dict = {
            'BalsnMetaClass' : BalsnMetaClass,
            'MasterMetaClass' : MasterMetaClass,
            'False' : False,
            'True' : True,
            'abs' : abs,
            'all' : all,
            'any' : any,
            'ascii' : ascii,
            'bin' : bin,
            'bool' : bool,
            'bytearray' : bytearray,
            'bytes' : bytes,
            'chr' : chr,
            'complex' : complex,
            'dict' : dict,
            'dir' : dir,
            'divmod' : divmod,
            'enumerate' : enumerate,
            'filter' : filter,
            'float' : float,
            'format' : format,
            'hash' : hash,
            'help' : help,
            'hex' : hex,
            'id' : id,
            'int' : int,
            'iter' : iter,
            'len' : len,
            'list' : list,
            'map' : map,
            'max' : max,
            'min' : min,
            'next' : next,
            'oct' : oct,
            'ord' : ord,
            'pow' : pow,
            'print' : print,
            'range' : range,
            'reversed' : reversed,
            'round' : round,
            'set' : set,
            'slice' : slice,
            'sorted' : sorted,
            'str' : str,
            'sum' : sum,
            'tuple' : tuple,
            'type' : type,
            'vars' : secure_vars,
            'zip' : zip,
            '__builtins__':None
            }

def createMethod(code):
    # if len(code) > 45:
    #     print('Too long!! Bad Guy!!')
    #     return
    for x in ' _$#@~':
        code = code.replace(x,'')
    def wrapper(self):
        exec(code, safe_dict, {'self' : self})
    return wrapper

def setName(pattern):
    while True:
        name = input(f'Give me your {pattern} name :')
        if (name.isalpha()):
            break
        else:
            print('Illegal Name...')
    return name

def setAttribute(cls):
    attrName = setName('attribute')
    while True:
        attrValue = input(f'Give me your value:')
        if (attrValue.isalnum()):
            break
        else:    
            print('Illegal value...')
    setattr(cls, attrName, attrValue)

def setMethod(cls):
    methodName = setName('method')
    code = input(f'Give me your function:')       
    func = createMethod(code)
    setattr(cls, methodName, func)

def getAttribute(obj):
    attrs = [attr for attr in dir(obj) if not callable(getattr(obj, attr)) and not attr.startswith("__")]
    x = input('Please enter the attribute\'s name :')
    if x not in attrs:
        print(f'You can\'t access the attribute {x}')
        return
    else:
        try:
            print(f'{x}: {getattr(obj, x)}')
        except:
            print("Something went wrong in your attribute...")
            return

def callMethod(cls, obj):
    attrs = [attr for attr in dir(obj) if callable(getattr(obj, attr)) and not attr.startswith("__")]
    x = input('Please enter the method\'s name :')
    if x not in attrs:
        print(f'You can\'t access the method {x}')
        return
    else:
        # try:
        print(f'calling method {x}...')
        cls.__dict__[x](obj)
        print('done')
        # except:
        #     print('Something went wrong in your method...')
        #     return

class Guest(metaclass = BalsnMetaClass):
    pass

if __name__ == '__main__':
    print(f'Welcome!!We have prepared a class named "Guest" for you')
    cnt = 0
    while cnt < 3:
        cnt += 1
        print('1. Add attribute')
        print('2. Add method')
        print('3. Finish')
        x = input("Option ? :")
        if x == "1":
            setAttribute(Guest)
        elif x == "2":
            setMethod(Guest)
        elif x == "3":
            break
        else:
            print("invalid input.")
            cnt -= 1
    print("Well Done! We Create an instance for you !")
    obj = Guest()
    cnt = 0
    while cnt < 3:
        cnt += 1
        print('1. Inspect attribute')
        print('2. Using method')
        print('3. Exit')
        x = input("Option ? :")
        if x == "1":
            getAttribute(obj)
        elif x == "2":
            callMethod(Guest, obj)
        elif x == "3":
            print("Okay...exit...")
            break
        else:
            print("invalid input.")
            cnt -= 1