57 lines
1.8 KiB
Python
57 lines
1.8 KiB
Python
|
|
import unittest, frappe
|
|
from frappe.utils.safe_exec import safe_exec, get_safe_globals
|
|
|
|
class TestSafeExec(unittest.TestCase):
|
|
def test_import_fails(self):
|
|
self.assertRaises(ImportError, safe_exec, 'import os')
|
|
|
|
def test_internal_attributes(self):
|
|
self.assertRaises(SyntaxError, safe_exec, '().__class__.__call__')
|
|
|
|
def test_utils(self):
|
|
_locals = dict(out=None)
|
|
safe_exec('''out = frappe.utils.cint("1")''', None, _locals)
|
|
self.assertEqual(_locals['out'], 1)
|
|
|
|
def test_safe_eval(self):
|
|
self.assertEqual(frappe.safe_eval('1+1'), 2)
|
|
self.assertRaises(AttributeError, frappe.safe_eval, 'frappe.utils.os.path', get_safe_globals())
|
|
|
|
def test_sql(self):
|
|
_locals = dict(out=None)
|
|
safe_exec('''out = frappe.db.sql("select name from tabDocType where name='DocType'")''', None, _locals)
|
|
self.assertEqual(_locals['out'][0][0], 'DocType')
|
|
|
|
self.assertRaises(frappe.PermissionError, safe_exec, 'frappe.db.sql("update tabToDo set description=NULL")')
|
|
|
|
def test_query_builder(self):
|
|
_locals = dict(out=None)
|
|
safe_exec(script='''out = frappe.qb.from_("User").select(frappe.qb.terms.PseudoColumn("Max(name)")).run()''', _globals=None, _locals=_locals)
|
|
self.assertEqual(frappe.db.sql("SELECT Max(name) FROM tabUser"), _locals["out"])
|
|
|
|
def test_safe_query_builder(self):
|
|
self.assertRaises(frappe.PermissionError, safe_exec, '''frappe.qb.from_("User").delete().run()''')
|
|
|
|
def test_call(self):
|
|
# call non whitelisted method
|
|
self.assertRaises(
|
|
frappe.PermissionError,
|
|
safe_exec,
|
|
"""frappe.call("frappe.get_user")"""
|
|
)
|
|
|
|
# call whitelisted method
|
|
safe_exec("""frappe.call("ping")""")
|
|
|
|
|
|
def test_enqueue(self):
|
|
# enqueue non whitelisted method
|
|
self.assertRaises(
|
|
frappe.PermissionError,
|
|
safe_exec,
|
|
"""frappe.enqueue("frappe.get_user", now=True)"""
|
|
)
|
|
|
|
# enqueue whitelisted method
|
|
safe_exec("""frappe.enqueue("ping", now=True)""")
|