#!/usr/bin/python2 import jsparser, re, sys, types, getopt import cgi import cgitb RESERVED_WORDLIST = ['document', 'window', 'document' 'alert', 'console', '$', 'jQuery', 'xmlhttp', 'eval', 'XMLHttpRequest', 'String', 'this'] opt_v = False ITERATION_BLOCKS = ['expression', 'body', 'block', 'initializer', 'condition', 'thenPart', 'elsePart', 'tryBlock', 'catchClauses', 'varDecls'] def test_script(tree, rec_level = 1): if opt_v: sys.stderr.write( 'test_script(tree,%d)' % rec_level); for i, v in enumerate(tree): if v.type == 'IDENTIFIER' and v.value in RESERVED_WORDLIST: return 'BAD SCRIPT ERROR reserved word "%s" used in assignment at line number %s\n' % (v.value, v.lineno) if v.type == 'STRING': return 'BAD SCRIPT ERROR illegal type "%s" used at line number %s\n' % (v.type, v.lineno) if opt_v: sys.stderr.write( 'this is the type: %s at line number %s\n' % (v.type, v.lineno)); if opt_v: sys.stderr.write( 'this is the value: %s at line number %s\n' % (v.value, v.lineno)); inner_test = test_script(v, rec_level + 1) if inner_test: return inner_test for block in ITERATION_BLOCKS: if hasattr(tree, block): b = getattr(tree, block) try: if opt_v: sys.stderr.write( ' this is the expression type: %s \n' % getattr(b, 'type')); except Exception as e: sys.stderr.write('python execution error %s \n' % e) continue try: for i, v in enumerate(b): if b.type == 'PLUS' and v.type == 'ARRAY_INIT': return 'BAD SCRIPT ERROR illegal use of arrays to cast strings at %s\n' % v.lineno if opt_v: sys.stderr.write( 'this is the (inner iteration) type: %s, at line number %s, rec_lev: %d' % (v.type, v.lineno, rec_level)); if v.type == 'STRING': return 'BAD SCRIPT ERROR illegal type "%s" used at line number %s\n' % (v.type, v.lineno) if opt_v: sys.stderr.write( 'this is the (inner iteration) value: %s\n' % v.value); inner_test = test_script(v, rec_level + 1) if inner_test: return inner_test except Exception as e: sys.stderr.write('this was the error %s\n' % e) continue if opt_v: sys.stderr.write( 'test_script(tree,%d) end\n' % rec_level); return False if __name__ == "__main__": f = open(sys.argv[1], 'r') data = f.read() f.close() test = jsparser.parse(data) test = test_script(test) if test: print( test) sys.exit(1) else: sys.exit(0)