From 65a2cdcffc2c4e71d8e0700c741f3da61a97c101 Mon Sep 17 00:00:00 2001 From: Suraj Shetty Date: Sun, 4 Jun 2023 08:59:08 +0530 Subject: [PATCH] fix(safe_eval): Normalize code passed before validating the code --- frappe/__init__.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/frappe/__init__.py b/frappe/__init__.py index e5a0b9c4aa..68797d2f06 100644 --- a/frappe/__init__.py +++ b/frappe/__init__.py @@ -16,6 +16,7 @@ import inspect import json import os import re +import unicodedata import warnings from typing import TYPE_CHECKING, Any, Callable, Literal, Optional, TypeAlias, overload @@ -2271,6 +2272,7 @@ def bold(text): def safe_eval(code, eval_globals=None, eval_locals=None): """A safer `eval`""" whitelisted_globals = {"int": int, "float": float, "long": int, "round": round} + code = unicodedata.normalize("NFKC", code) UNSAFE_ATTRIBUTES = { # Generator Attributes