security fixes

raspberryjammod/mcpipy/digitalclock.py

@@ -8,19 +8,24 @@ import datetime
 import time
 import sys
 import fonts
+import ast
 
 foreground = SEA_LANTERN # this needs Minecraft 1.8
 background = AIR
 
+def parseBlock(s):
+    try:
+        return ast.literal_eval(s)
+    except:
+        return globals()[s.upper()]
+
 try:
-    if len(sys.argv) > 1 and not "__" in sys.argv[1]:
-        foreground = eval(sys.argv[1])
+    foreground = parseBlock(sys.argv[1])
 except:
     pass
 
 try:
-    if len(sys.argv) > 2 and not "__" in sys.argv[2]:
-        background = eval(sys.argv[2])
+    background = parseBlock(sys.argv[2])
 except:
     pass
 

raspberryjammod/mcpipy/explosify.py

@@ -2,32 +2,35 @@
 # Code under the MIT license by Alexander Pruss
 #
 
-import mcpi.minecraft as minecraft
-import mcpi.block as block
+from mc import *
 import math
 import sys
+from ast import literal_eval
 
-def replace(mcx,mcy,mcz,R,mcblock,mcmeta):
+def parseBlock(s):
+    try:
+        return literal_eval(s)
+    except:
+        return globals()[s.upper()]
+
+def replace(mcx,mcy,mcz,R,mcblock):
   for x in range(-R,R):
      for y in range(-R,R):
          for z in range(-R,R):
-            if (x**2 + y**2 + z**2 <= R**2 and mc.getBlock(mcx+x,mcy+y,mcz+z) != block.AIR.id):
-                mc.setBlock(mcx+x,mcy+y,mcz+z,mcblock,mcmeta)
+            if (x**2 + y**2 + z**2 <= R**2 and mc.getBlock(mcx+x,mcy+y,mcz+z) != AIR.id):
+                mc.setBlock(mcx+x,mcy+y,mcz+z,mcblock)
 
-mc = minecraft.Minecraft()
+mc = Minecraft()
 
 playerPos = mc.player.getPos()
 R = 20
-b = block.TNT.id
-m = 0
+b = TNT
 
 if len(sys.argv) >= 2:
    R = int(sys.argv[1])
    if len(sys.argv) >= 3:
-      b = int(sys.argv[2])
-      if len(sys.argv) >= 4:
-          m  = int(sys.argv[3])
+      b = parseBlock(sys.argv[2])
 
-replace(playerPos.x, playerPos.y, playerPos.z, R, b, m)
+replace(playerPos.x, playerPos.y, playerPos.z, R, b)
 
 mc.postToChat("Explosify done")

raspberryjammod/mcpipy/sphere.py

@@ -1,5 +1,13 @@
 from mcturtle import *
 import sys
+from ast import literal_eval
+
+def parseBlock(s):
+    try:
+        return literal_eval(s)
+    except:
+        return globals()[s.upper()]
+
 t = Turtle()
 t.pendelay(0)
 if len(sys.argv) >= 2:
@@ -7,7 +15,7 @@ if len(sys.argv) >= 2:
 else:
     radius = 10
 if len(sys.argv) >= 3:
-    material = eval(sys.argv[2].replace("__","(undefined)"))
+    material = parseBlock(sys.argv[2])
 else:
     material = GOLD_BLOCK
 t.penwidth(2*radius)

raspberryjammod/mcpipy/vehicle.py

@@ -27,6 +27,7 @@ from mcpi.block import *
 from math import *
 from sys import maxsize
 from copy import copy
+from ast import literal_eval
 import re
 
 def getSavePath(directory, extension):
@@ -122,19 +123,23 @@ class Vehicle():
         f.write("baseAngle,highWater,baseVehicle="+repr((self.baseAngle,self.highWater,self.baseVehicle))+"\n")
         f.close()
 
-    @staticmethod
-    def safeEval(string):
-        if "__" in string:
-            raise ValueError
-        return eval(string)
-
     def load(self,filename):
         with open(filename) as f:
             data = ''.join(f.readlines())
             result = re.search("=\\s*(.*)",data)
             if result is None:
                 raise ValueError
-            self.baseAngle,self.highWater,self.baseVehicle = Vehicle.safeEval(result.group(1))
+            self.baseAngle,self.highWater,v = literal_eval(result.group(1).replace("Block",""))
+            self.baseVehicle = {}
+            for key,value in v.items():
+                if isinstance(value,tuple):
+                   if len(value) > 1:
+                       self.baseVehicle[key] = Block(value[0], value[1])
+                   else:
+                       self.baseVehicle[key] = Block(value[0])
+                else:
+                   self.baseVehicle[key] = Block(value)  
+
         self.curLocation = None
 
     def safeSetBlockWithData(self,pos,block):