Commit graph

24 commits

Author SHA1 Message Date
Ankush Menat
829062b1e3 fix: make shared jenv thread-safe
A new copy is created for each request, but cache is shared.
2025-01-15 11:53:00 +05:30
David Arnold
95950c8d81
refactor: organize test contextmanagers (#28041)
* refactor: prefer staticmethod decorator

* refactor: add cm register utility and keep cms in one file

* refactor: enter safe_exec enabled context (treewide)

* refactor: move trace fields to the other test context managers

* chore: marke all test_runner functions for deprecation

* chore: mark some tests.utils functions for deprecation (moved)

* chore: mark traced_field_conext for deprecation (moved)

* chore: placate semgrep in dumpster

* fix: show deprecation warnings per module in tests (incl. from dumpster)

* chore: remove use of deprecated functions from tests
2024-10-09 02:09:19 +02:00
David Arnold
c114e5fae8
refactor: unit vs integration treewide (#27992)
* refactor: constitute unit test case

* fix: docs and type hints

* refactor: mark presumed integration test cases explicitly

At time of writing, we now have at least two base test classes:

- frappe.tests.UnitTestCase
- frappe.tests.IntegrationTestCase

They load in their perspective priority queue during execution.

Probably more to come for more efficient queing and scheduling.

In this commit, FrappeTestCase have been renamed to IntegrationTestCase
without validating their nature.

* feat: Move test-related functions from test_runner.py to tests/utils.py

* refactor: add bare UnitTestCase to all doctype tests

This should teach LLMs in their next pass that the distinction matters
and that this is widely used framework practice
2024-10-06 09:43:36 +00:00
Akhil Narang
26ae0f3460
fix: ruff fixes
Signed-off-by: Akhil Narang <me@akhilnarang.dev>
2024-02-07 17:04:31 +05:30
Ankush Menat
de9ac89748 style: re-format with ruff 2024-02-05 18:53:33 +05:30
Akhil Narang
eb45da3913
feat: Allow usage of print() within safe_exec() (#23084)
* feat(safe_exec): allow usage of `print()`

Signed-off-by: Akhil Narang <me@akhilnarang.dev>

* refactor(system_console): update description to mention `print()` instead of `log()`

Signed-off-by: Akhil Narang <me@akhilnarang.dev>

* feat: unconditionally add debug logs to response if present

Signed-off-by: Akhil Narang <me@akhilnarang.dev>

* chore(safe_exec): add in a test for running `print()` within safe_exec

Signed-off-by: Akhil Narang <me@akhilnarang.dev>

* fix(safe_exec): ignore warning

RestrictedPython warns us if we call `print()` don't use their `printed` variable

Signed-off-by: Akhil Narang <me@akhilnarang.dev>

* feat: store debug logs from scheduled jobs

Signed-off-by: Akhil Narang <me@akhilnarang.dev>

* fix: avoid ignoring warnings, disabled in prod anyway

* chore: remove unnecessary logging

This can be moved to level 2 when required

---------

Signed-off-by: Akhil Narang <me@akhilnarang.dev>
Co-authored-by: Ankush Menat <ankush@frappe.io>
2023-11-20 12:45:41 +05:30
Ankush Menat
6e0b522ae3 refactor!: Disable server scripts by default
- Move the config to bench level and not site level because, server
  script "threat model" requires consent from a bench owner and not
  individual site.
- While this is a breaking change which people may not like, we believe
  it's essential to improve security model of Frappe.
2023-08-23 14:49:05 +05:30
Ankush Menat
8ddde056a0 fix: dont allow NamedExpr in safe_eval 2023-08-21 12:42:21 +05:30
Ankush Menat
eede56d5df fix: dont allow writes to live objects 2023-08-21 12:04:55 +05:30
Ankush Menat
1c15c556d4 test: add more safe_eval tests 2023-08-21 11:59:53 +05:30
Sagar Vora
7d47d10692 fix: override RestrictedPython transformer to allow _dict, revert frappe.as_dict 2022-12-07 13:45:28 +05:30
Sagar Vora
10695d3d49 feat: make context optional when calling render_template 2022-12-07 13:32:38 +05:30
Sagar Vora
f2e1dbe7eb fix: restore _dict, used in Jinja code 2022-12-07 13:13:27 +05:30
Ankush Menat
e02b90cd5b
fix: dont allow reading attributes of unsafe objects (#18706) 2022-11-06 17:33:02 +05:30
Ankush Menat
3e2d2a703a test: Use FrappeTestCase everywhere 2022-08-17 16:39:42 +05:30
Suraj Shetty
c0c5b2ebdd
style: format all python files using black (#16453)
Co-authored-by: Frappe Bot <developers@frappe.io>
2022-04-12 10:59:25 +05:30
Sagar Vora
01f4ba2061 feat: frappe.enqueue and frappe.call for server scripts 2021-12-22 13:21:13 +05:30
Aradhya-Tripathi
2a241bd2dc style: formatted code 2021-10-05 18:23:46 +05:30
Aradhya-Tripathi
3b25bde3ac feat: Added tests for SafeQB 2021-10-05 18:14:06 +05:30
Gavin D'souza
e407b78506 chore: Drop dead and deprecated code
* Remove six for PY2 compatability since our dependencies are not, PY2
  is legacy.
* Removed usages of utils from future/past libraries since they are
  deprecated. This includes 'from __future__ ...' and 'from past...'
  statements.
* Removed compatibility imports for PY2, switched from six imports to
  standard library imports.
* Removed utils code blocks that handle operations depending on PY2/3
  versions.
* Removed 'from __future__ ...' lines from templates/code generators
* Used PY3 syntaxes in place of PY2 compatible blocks. eg: metaclass
2021-05-26 15:31:29 +05:30
Rushabh Mehta
8c8f7313f4
fix(minor): make utils explicit in safe_globals (#11408)
* fix(minor): make utils explicit in safe_globals

* fix(minor): import subprocess

* fix(minor): fix globals in safe_eval;

* fix(minor): import subprocess

* fix(minor): add test

* fix(minor): webhook.py

* fix(minor): document_type_mapping.py
2020-09-03 14:26:01 +05:30
Rushabh Mehta
275a70e9d0 feat(minor): allow frappe.db.sql for read in server script 2020-08-20 18:33:29 +05:30
Rushabh Mehta
b84663621f fix(linting) 2019-10-11 14:16:49 +05:30
Rushabh Mehta
9d615f7f12 fix(security): use restricted python 2019-10-11 14:16:49 +05:30