patches/Restricted: allow os.urandom

product/ERP5Type/patches/Restricted.py

@@ -347,3 +347,4 @@ del member_id, member
 
 from random import SystemRandom
 allow_type(SystemRandom)
+ModuleSecurityInfo('os').declarePublic('urandom')

product/ERP5Type/tests/testRestrictedPythonSecurity.py

@@ -125,3 +125,15 @@ class TestRestrictedPythonSecurity(ERP5TypeTestCase):
   def testSystemRandom(self):
     self.createAndRunScript('import random',
                             'return random.SystemRandom().getrandbits(10)')
+
+  def test_os_urandom(self):
+    self.createAndRunScript('import os',
+                            'return os.urandom(10)')
+    # other "unsafe" os members are not exposed
+    self.assertRaises(Unauthorized,
+      self.createAndRunScript, 'import os',
+                               'return os.path.exists("/")')
+    self.assertRaises(Unauthorized,
+      self.createAndRunScript, 'import os',
+                               'return os.system')
+