Glassvision/IfcOpenShell
1
0
Fork 0
mirror of https://github.com/IfcOpenShell/IfcOpenShell.git synced 2026-09-20 23:36:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

Drawing text annotation now use the new format functions instead of executing arbitrary code.

Browse Source
This commit is contained in:
Dion Moult
2023-09-07 13:05:03 +10:00
parent b792fff98c
commit e8b52d3d93
2 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/blenderbim/blenderbim/tool/drawing.py
+3 -2
View File
@@ -1391,8 +1391,9 @@ class Drawing(blenderbim.core.tool.Drawing):
original_command = command original_command = command
for variable in re.findall("{{.*?}}", command): for variable in re.findall("{{.*?}}", command):
value = ifcopenshell.util.selector.get_element_value(product, variable[2:-2]) value = ifcopenshell.util.selector.get_element_value(product, variable[2:-2])
command = command.replace(variable, repr(value)) value = '"' + str(value).replace('"', '\\"') + '"'
text = text.replace(original_command, str(eval(command[2:-2]))) command = command.replace(variable, value)
text = text.replace(original_command, ifcopenshell.util.selector.format(command[2:-2]))
for variable in re.findall("{{.*?}}", text): for variable in re.findall("{{.*?}}", text):
value = ifcopenshell.util.selector.get_element_value(product, variable[2:-2]) value = ifcopenshell.util.selector.get_element_value(product, variable[2:-2])
src/ifccsv/ifccsv.py
+1 -1
View File
@@ -238,7 +238,7 @@ class IfcCsv:
if row[index] == null: if row[index] == null:
continue continue
if not isinstance(row[index], str): if not isinstance(row[index], str):
row[index] = '"' + str(row[index]) + '"' row[index] = '"' + str(row[index]).replace('"', '\\"') + '"'
row[index] = ifcopenshell.util.selector.format(format_query.replace("{{value}}", row[index])) row[index] = ifcopenshell.util.selector.format(format_query.replace("{{value}}", row[index]))
def sort_results(self, sort, attributes, include_global_id): def sort_results(self, sort, attributes, include_global_id):