c2c-oerpscenario team mailing list archive

["Olivier Dony \(OpenERP\)" <703841@xxxxxxxxxxxxxxxxxx>]

Yes, actually after reviewing the various versions of Python on Windows, we found out that on 2.5.2 the call to the oft-used datetime.datetime.now() triggers an "import time" from the native C code.
This is a peculiar behavior of this version+platform combination, but the same can be reproduced more easily on linux or other versions with datetime.datetime.strftime():

Python 2.6.6 (r266:84292, Sep 15 2010, 16:22:56) 
[GCC 4.4.5] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> _org_import = __builtins__.__import__
>>> def _import(name, *args):
...     print "importing", name
...     return _org_import(name, *args)
... 
>>> __builtins__.__import__ = _import
>>> import datetime
importing datetime
>>> now = datetime.datetime.now() # ok on linux+2.6, no hidden import
>>> datetime.datetime.strftime(now,"%H:%M:%S") # will trigger 'import time'
importing time
'17:51:33'
>>>


There is apparently no way to prevent this, these datetime functions are frequently needed, so the only possible solution is to allow "import time" within safe_eval, even when the time module is already provided in the context. 
The time module is considered safe, so there is not security risk in allowing this.
Should we find other similar cases where safe_eval() blocks an indirect call to "import" that we would like to allow, we'll have to evaluate the risks involved in allowing that module as well in ALLOWED_MODULES.

Hope this clears up the situation a bit.


For those interested by the technical details, you can dig in the source code of Python's datetime module to discover that datetime_now() in turn calls datetime_best_possible() which contains 2 different implementations, depending on the platform's support for gettimeofday() [1]. As there is no gettimeofday() on windows, the alternative implementation is to construct a datetime based on a timestamp provided by the time module, hence the import via time_time() [2],[3].

[1] http://svn.python.org/view/python/tags/r252/Modules/datetimemodule.c?view=markup#l3719
[2] http://svn.python.org/view/python/tags/r252/Modules/datetimemodule.c?view=markup#l3743
[3] http://svn.python.org/view/python/tags/r252/Modules/datetimemodule.c?view=markup#l1363

-- 
You received this bug notification because you are a member of C2C
OERPScenario, which is subscribed to the OpenERP Project Group.
https://bugs.launchpad.net/bugs/703841

Title:
  v6 ImportError: time

Status in OpenERP Server:
  Fix Released

Bug description:
  Hi,
  windows vista
  addons rev 4248

  when I install modules with configurator, the configurator don't
  finish all options (without error popup), I have this error in the
  server log :

  [2011-01-17 09:28:40,229][aaaa] INFO:init:module hr_timesheet_sheet: loading test/test_hr_timesheet_sheet.yml
  [2011-01-17 09:28:40,864][aaaa] ERROR:tests.hr_timesheet_sheet:time
  Traceback (most recent call last):
    File "tools\yaml_import.pyo", line 729, in process
    File "tools\yaml_import.pyo", line 742, in _process_node
    File "tools\yaml_import.pyo", line 317, in process_record
    File "tools\yaml_import.pyo", line 330, in _create_record
    File "tools\yaml_import.pyo", line 391, in _eval_field
    File "tools\yaml_import.pyo", line 357, in process_eval
    File "tools\safe_eval.pyo", line 281, in safe_eval
    File "", line 1, in <module>
    File "tools\safe_eval.pyo", line 215, in _import
  ImportError: time
  [2011-01-17 09:28:40,864][aaaa] ERROR:test:Tests failed to execute in module hr_timesheet_sheet
  Traceback (most recent call last):
    File "addons\__init__.pyo", line 670, in load_test
    File "addons\__init__.pyo", line 693, in _load_data
    File "tools\yaml_import.pyo", line 794, in yaml_import
    File "tools\yaml_import.pyo", line 729, in process
    File "tools\yaml_import.pyo", line 742, in _process_node
    File "tools\yaml_import.pyo", line 317, in process_record
    File "tools\yaml_import.pyo", line 330, in _create_record
    File "tools\yaml_import.pyo", line 391, in _eval_field
    File "tools\yaml_import.pyo", line 357, in process_eval
    File "tools\safe_eval.pyo", line 281, in safe_eval
    File "", line 1, in <module>
    File "tools\safe_eval.pyo", line 215, in _import
  ImportError: time

  bye