@@ -300,6 +300,9 @@ def generate_validator_testcases(valid):
300300 ValueError ),
301301 ("cycler('c', [j.__class__(j).lower() for j in ['r', 'b']])" ,
302302 ValueError ),
303+ # list comprehensions are arbitrary code, even if "safe"
304+ ("cycler('color', [x for x in ['r', 'g', 'b']])" ,
305+ ValueError ),
303306 ('1 + 2' , ValueError ), # doesn't produce a Cycler object
304307 ('os.system("echo Gotcha")' , ValueError ), # os not available
305308 ('import os' , ValueError ), # should not be able to import
@@ -466,14 +469,6 @@ def test_validate_cycler_bad_color_string():
466469 validate_cycler ("cycler('color', 'foo')" )
467470
468471
469- def test_validate_cycler_no_code_execution ():
470- # List comprehensions are arbitrary code. The old eval()-based parser
471- # would execute this successfully, but the AST-based parser rejects it
472- # because only literal values are allowed in cycler arguments.
473- with pytest .raises (ValueError ):
474- validate_cycler ("cycler('color', [x for x in ['r', 'g', 'b']])" )
475-
476-
477472@pytest .mark .parametrize ('weight, parsed_weight' , [
478473 ('bold' , 'bold' ),
479474 ('BOLD' , ValueError ), # weight is case-sensitive
0 commit comments