Test that validate_cycler does not execute code passed in

scottshambaugh · scottshambaugh · commit 0065bfc655eb · 2026-03-06T17:41:55.000-07:00
diff --git a/lib/matplotlib/rcsetup.py b/lib/matplotlib/rcsetup.py
@@ -1179,7 +1179,7 @@ def _convert_validator_spec(key, conv):
     "axes.formatter.offset_threshold": validate_int,
     "axes.unicode_minus": validate_bool,
     # This entry can be either a cycler object or a string repr of a
-    # cycler-object, which gets eval()'ed to create the object.
+    # cycler-object, which is parsed safely via AST.
     "axes.prop_cycle": validate_cycler,
     # If "data", axes limits are set close to the data.
     # If "round_numbers" axes limits are set to the nearest round numbers.
diff --git a/lib/matplotlib/tests/test_rcparams.py b/lib/matplotlib/tests/test_rcparams.py
@@ -276,13 +276,9 @@ def generate_validator_testcases(valid):
                      (cycler(mew=[2, 5]),
                       cycler('markeredgewidth', [2, 5])),
                      ),
-         # This is *so* incredibly important: validate_cycler() eval's
-         # an arbitrary string! I think I have it locked down enough,
-         # and that is what this is testing.
-         # TODO: Note that these tests are actually insufficient, as it may
-         # be that they raised errors, but still did an action prior to
-         # raising the exception. We should devise some additional tests
-         # for that...
+         # validate_cycler() parses an arbitrary string using a safe
+         # AST-based parser (no eval). These tests verify that only valid
+         # cycler expressions are accepted.
          'fail': ((4, ValueError),  # Gotta be a string or Cycler object
                   ('cycler("bleh, [])', ValueError),  # syntax error
                   ('Cycler("linewidth", [1, 2, 3])',
@@ -464,6 +460,14 @@ def test_validate_cycler_bad_color_string():
         validate_cycler("cycler('color', 'foo')")
 
 
+def test_validate_cycler_no_code_execution():
+    # List comprehensions are arbitrary code. The old eval()-based parser
+    # would execute this successfully, but the AST-based parser rejects it
+    # because only literal values are allowed in cycler arguments.
+    with pytest.raises(ValueError):
+        validate_cycler("cycler('color', [x for x in ['r', 'g', 'b']])")
+
+
 @pytest.mark.parametrize('weight, parsed_weight', [
     ('bold', 'bold'),
     ('BOLD', ValueError),  # weight is case-sensitive
