fix a hole in sandboxing allowing builtin file to write outside of the sandbox

--HG--
branch : distribute
extra : rebase_source : 5ff181b30f41080ec0e0628c96abf270ffe1a730

CHANGES.txt

@@ -6,6 +6,8 @@ CHANGES
 0.6.5
 -----
 
+* Fixed a hole in sandboxing allowing builtin file to write outside of
+  the sandbox.
 
 -----
 0.6.4

setuptools/sandbox.py

@@ -168,6 +168,12 @@ class DirectorySandbox(AbstractSandbox):
     def _violation(self, operation, *args, **kw):
         raise SandboxViolation(operation, args, kw)
 
+    if _file:
+        def _file(self, path, mode='r', *args, **kw):
+            if mode not in ('r', 'rt', 'rb', 'rU', 'U') and not self._ok(path):
+                self._violation("file", path, mode, *args, **kw)
+            return _file(path,mode,*args,**kw)
+
     def _open(self, path, mode='r', *args, **kw):
         if mode not in ('r', 'rt', 'rb', 'rU', 'U') and not self._ok(path):
             self._violation("open", path, mode, *args, **kw)