patches/Restricted: allow os.urandom

product/ERP5Type/patches/Restricted.py

@@ -347,3 +347,4 @@ del member_id, member
 
 from random import SystemRandom
 allow_type(SystemRandom)
+ModuleSecurityInfo('os').declarePublic('urandom')

product/ERP5Type/tests/testRestrictedPythonSecurity.py

@@ -128,6 +128,18 @@ class TestRestrictedPythonSecurity(ERP5TypeTestCase):
     self.createAndRunScript('import random',
                             'return random.SystemRandom().getrandbits(10)')
 
+  def test_os_urandom(self):
+    self.createAndRunScript('import os',
+                            'return os.urandom(10)')
+    # other "unsafe" os members are not exposed
+    self.assertRaises(Unauthorized,
+      self.createAndRunScript, 'import os',
+                               'return os.path.exists("/")')
+    self.assertRaises(Unauthorized,
+      self.createAndRunScript, 'import os',
+                               'return os.system')
+
+
 def test_suite():
   suite = unittest.TestSuite()
   suite.addTest(unittest.makeSuite(TestRestrictedPythonSecurity))