From 6a00e3d748a83ec7357d461d83bcdff27a20b8d6 Mon Sep 17 00:00:00 2001 From: Aleksey Maksimov Date: Sat, 23 Nov 2013 17:28:34 +0800 Subject: [PATCH] Changed eval() to ast.literal_eval() for safety --- jenkinsapi/jenkinsbase.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/jenkinsapi/jenkinsbase.py b/jenkinsapi/jenkinsbase.py index 00840c9..bc5624b 100644 --- a/jenkinsapi/jenkinsbase.py +++ b/jenkinsapi/jenkinsbase.py @@ -2,6 +2,7 @@ Module for JenkinsBase class """ +import ast import logging from jenkinsapi import config from jenkinsapi.custom_exceptions import JenkinsAPIException @@ -61,7 +62,7 @@ class JenkinsBase(object): requester = self.get_jenkins_obj().requester response = requester.get_url(url, params) try: - return eval(response.text) + return ast.literal_eval(response.text) except Exception: log.exception('Inappropriate content found at %s', url) raise JenkinsAPIException('Cannot parse %s' % response.content) -- 2.34.1