viur-framework / logics Goto Github PK

for-loops should support a max-iteration count, which may not exceed a fixed number of iterations, e.g. 1000.

In Logics, division by zero should be handled and return a str "#ERR: division by zero"

Python 3.11.5 (main, Aug 28 2023, 20:02:58) [GCC 13.2.1 20230801] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import logics
>>> logics.Value("10") // 0
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/tmp/logics/logics-py/logics/value.py", line 264, in __floordiv__
    return Value(int(self) // int(other))
                 ~~~~~~~~~~^^~~~~~~~~~~~
ZeroDivisionError: integer division or modulo by zero
>>> logics.Value("10") / 0
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/tmp/logics/logics-py/logics/value.py", line 260, in __truediv__
    return Value(int(self) / int(other))
                 ~~~~~~~~~~^~~~~~~~~~~~
ZeroDivisionError: division by zero

A syntax for tuples should be made available, equal to lists.

• [1, 2, 3] equals to (1, 2, 3)
• [1] equals to (1, )

This is only for syntactical co-existence with Python's syntax.
Lists are not considered to be mutable in Logics, equal to tuples in Python.

It would be great to have logics-py and logics-js being tested against a test-suite with, to ensure equal results in both implementations.

The range() function must be made available to logics expressions also.

Slice-notations like x[from:until] should also be supported by logics to implement several custom issues.

The expression 'x' * 9999999999 generates a string which is 9999999999 bytes long (9536 MB). This is possible, but should be limited, both by the integer count and by the string length. 100K should satisfy (104857600 bytes).

This test case:

max(3, 7, 2) == 7
#EXPECT:True

does not work in logics-js but it works in logics-py
The problem seems to be with the max function, because the min function works.

Here is a screenshot with the case in logics-js:

EDIT: The min function is not working correct too.

It seems that only the first value is taken into account

EDIT2: For the max function its the same like the min function, only the first value is taken into account

To further improve the security features of Logics, it is necessary to set a stack limit. if the execution stack exceeds a certain limit, the program execution should be interrupted with an error string.

This test case:

(x > 10 and ("hello" + "world" == "helloworld" or x % 3 == 0)) or (x < 5 and "foo" in "foobar")
#EXPECT:True

works in logics-js but not in logics-py

Here is a screenshot with both cases:

This test case:

8724 < sum([x * x for x in (500, 1000, 90, 250, 25) if x < 100])
#EXPECT:True

does not work in logics-py but it works in logics-js

The problem seems to be with the sum function as the comprehension produces the right result
Here is a screenshot with both cases.

Adding e.g. an int to a list is currently failing. It should be handled like in LeopoldWichtel@4308c2d

>>> logics.Value([1,2,3]) + 4
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/tmp/logics/logics-py/logics/value.py", line 221, in __add__
    return Value(int(self) + int(other))
                 ^^^^^^^^^
  File "/tmp/logics/logics-py/logics/value.py", line 138, in __int__
    return int(self.value)
           ^^^^^^^^^^^^^^^
TypeError: int() argument must be a string, a bytes-like object or a real number, not 'list'
>>>

Generelly, an Exception shall not be thrown in this case.

my input like flow
{"tags" : ["dog","black"," female"],“name”:"dog1"}
{"tags" : ["pig","black"," female"],“name”:"pig1"}
{"tags" : ["cow","black"," female"],“name”:"cow1"}

my rule like this :
tags = dog

My expected output is
true
false
fase

Can we do that?

It should also be possible to define dicts in Logics. This is, because they might be useful as parameters or for tests.

I installed logics

$ python -m pip install logics-py -U
Defaulting to user installation because normal site-packages is not writeable
Requirement already satisfied: logics-py in /home/sven/.local/lib/python3.10/site-packages (0.0.3)

and tried to run the CLI

$ python -m logics
Traceback (most recent call last):
  File "/usr/lib/python3.10/runpy.py", line 196, in _run_module_as_main
    return _run_code(code, main_globals, None,
  File "/usr/lib/python3.10/runpy.py", line 86, in _run_code
    exec(code, run_globals)
  File "/home/sven/.local/lib/python3.10/site-packages/logics/__main__.py", line 2, in <module>
    from logics import Logics
ImportError: cannot import name 'Logics' from 'logics' (unknown location)

But this failed. How can I test expression?

Functions currently can only be called with positional arguments.
This is not useful, especially because there are function with default values.
Syntax for keyword-arguments with a specific abstraction in both implementations has to be established.

Currently, MAX_STRING_LENGTH (logics-py) / maxStringLength (logics-js) are not enforced in all situations and can be bypassed. This vulnerability should be closed in favor of security.

This issue serves as a documentation of several vulnerable problems relating the limitation settings.

...and according to #19 in tuples as well.