@@ -297,6 +297,9 @@ def generate_validator_testcases(valid):
297297 ValueError ),
298298 ("cycler('c', [j.__class__(j).lower() for j in ['r', 'b']])" ,
299299 ValueError ),
300+ # list comprehensions are arbitrary code, even if "safe"
301+ ("cycler('color', [x for x in ['r', 'g', 'b']])" ,
302+ ValueError ),
300303 ('1 + 2' , ValueError ), # doesn't produce a Cycler object
301304 ('os.system("echo Gotcha")' , ValueError ), # os not available
302305 ('import os' , ValueError ), # should not be able to import
@@ -463,14 +466,6 @@ def test_validate_cycler_bad_color_string():
463466 validate_cycler ("cycler('color', 'foo')" )
464467
465468
466- def test_validate_cycler_no_code_execution ():
467- # List comprehensions are arbitrary code. The old eval()-based parser
468- # would execute this successfully, but the AST-based parser rejects it
469- # because only literal values are allowed in cycler arguments.
470- with pytest .raises (ValueError ):
471- validate_cycler ("cycler('color', [x for x in ['r', 'g', 'b']])" )
472-
473-
474469@pytest .mark .parametrize ('weight, parsed_weight' , [
475470 ('bold' , 'bold' ),
476471 ('BOLD' , ValueError ), # weight is case-sensitive
0 commit comments