diff --git a/odoo/tools/_monkeypatches.py b/odoo/tools/_monkeypatches.py index 40e337151dd..f6e6eb4b5b7 100644 --- a/odoo/tools/_monkeypatches.py +++ b/odoo/tools/_monkeypatches.py @@ -1,5 +1,10 @@ +import ast +import os +import logging from shutil import copyfileobj +_logger = logging.getLogger(__name__) + from werkzeug.datastructures import FileStorage try: @@ -22,3 +27,26 @@ else: xlsx.Element_has_iter = True FileStorage.save = lambda self, dst, buffer_size=1<<20: copyfileobj(self.stream, dst, buffer_size) + +orig_literal_eval = ast.literal_eval + +def literal_eval(expr): + # limit the size of the expression to avoid segmentation faults + # the default limit is set to 100KiB + # can be overridden by setting the ODOO_LIMIT_LITEVAL_BUFFER buffer_size_environment variable + + buffer_size = 102400 + buffer_size_env = os.getenv("ODOO_LIMIT_LITEVAL_BUFFER") + + if buffer_size_env: + if buffer_size_env.isdigit(): + buffer_size = int(buffer_size_env) + else: + _logger.error("ODOO_LIMIT_LITEVAL_BUFFER has to be an integer, defaulting to 100KiB") + + if len(expr) > buffer_size: + raise ValueError("expression can't exceed buffer limit") + + return orig_literal_eval(expr) + +ast.literal_eval = literal_eval