security ; drawing rate limit

raspberryjammod/init.lua

@@ -110,12 +110,15 @@ minetest.register_globalstep(function(dtime)
            minetest.log("action", "RJM websocket client attempting handshake")
         end
     end
+
+    local command_count = 1000
+
     for i = 1, #socket_client_list do
        err = false
        local line
        local finished = false
 
-       while not err do
+       while not err and not finished do
          local source = socket_client_list[i]
          line,err = source.client:receive(source.read_mode)
          if err == "closed" then
@@ -132,6 +135,11 @@ minetest.register_globalstep(function(dtime)
               end
               finished = true
               err = "handling"
+            else
+              command_count = command_count - 1
+              if command_count < 0 then
+                 finished = true
+              end
             end
          end
        end

raspberryjammod/mcpipy/ltree.py

@@ -1,4 +1,4 @@
-#
+#
 # Code under the MIT license by Alexander Pruss
 #
 

raspberryjammod/mcpipy/polyhedron.py

@@ -1,5 +1,5 @@
 #The software in this file is copyright 2003,2004 Simon Tatham and copyright 2015 Alexander Pruss
-#Based on code from http://www.chiark.greenend.org.uk/~sgtatham/polyhedra/
+#Based on code from # http://www.chiark.greenend.org.uk/~sgtatham/polyhedra/
 #
 #Permission is hereby granted, free of charge, to any person
 #obtaining a copy of this software and associated documentation files
@@ -755,3 +755,4 @@ if __name__ == "__main__":
 
     pos = d.mc.player.getPos()
     polyhedron(d,n,faceMode,pos.x, pos.y, pos.z, size,drawing.GLASS,drawing.STONE)
+

raspberryjammod/mcpipy/render.py

@@ -851,4 +851,4 @@ if __name__ == "__main__":
 
             mainloop()
     else:
-        go(os.path.dirname(os.path.realpath(sys.argv[0])) + "/" + "models/" + sys.argv[1] + ".txt", sys.argv[2:])
+        go("models/" + sys.argv[1] + ".txt", sys.argv[2:])

raspberryjammod/mcpipy/vehicle.py

@@ -129,16 +129,14 @@ class Vehicle():
             result = re.search("=\\s*(.*)",data)
             if result is None:
                 raise ValueError
-            self.baseAngle,self.highWater,v = literal_eval(result.group(1).replace("Block",""))
-            self.baseVehicle = {}
-            for key,value in v.items():
-                if isinstance(value,tuple):
-                   if len(value) > 1:
-                       self.baseVehicle[key] = Block(value[0], value[1])
-                   else:
-                       self.baseVehicle[key] = Block(value[0])
-                else:
-                   self.baseVehicle[key] = Block(value)  
+            
+            # Check to ensure only function called is Block() by getting literal_eval to
+            # raise an exception when "Block" is removed and the result isn't a literal.
+            # This SHOULD make the eval call safe, though USE AT YOUR OWN RISK. Ideally,
+            # one would walk the ast parse tree and use a whitelist.
+            literal_eval(result.group(1).replace("Block",""))
+
+            self.baseAngle,self.highWater,self.baseVehicle = eval(result.group(1))
 
         self.curLocation = None