[IMP] safe_eval: opcodes blacklist & cleanup

There are bytecode operations we don't support because we've never
needed them, and there are bytecode operations we don't support
because they're vectors of security issues.

Currently no difference is being made between the two, so when looking
to add a new opcodes it's hard to know whether it's been considered
and rejected or whether it just hasn't been considered (or found
useful) yet.

Add an explicit blacklist, which is explicitly subtracted to all
opcodes lists, to allow motivating the bans of certain
opcodes. Opcodes listed in no lists are the "graylists" of opcodes we
either haven't yet considered or have not had a use for.

Also cleanup the existing lists of opcodes to remove long-gone (or
even never-existing) opcodes, and add a few missing opcodes:

* DUP_TOPX was removed from Python 3, replaced by DUP_TOP_TWO
* STORE_MAP was removed in Python 3.5
* BINARY_DIVIDE and INPLACE_DIVIDE were removed from Python 3 (they
  were used to invoke P2's integer division)
* the SLICE+<X> were removed from Python 3, which only uses
  BUILD_SLICE
* CALL_FUNCTION_VAR and CALL_FUNCTION_VAR_KW were removed in Python
  3.6 and functionally replaced by CALL_FUNCTION_EX (bpo-27213)
* JUMP_IF_FALSE and JUMP_IF_TRUE were removed back in 2.7, replaced by
  POP_JUMP_* and JUMP_*_OR_POP (bpo-4715)
* various finally-related bytecode instructions were added to Python
  3.8 to improve and speed up the handling of return, break and
  continue (bpo-17611).
* INPLACE_REMAINDER, INPLACE_LEFTSHIFT and INPLACE_RIGHTSHIFT were
  mentioned in PEP 202 but never actually implemented: INPLACE_
  instructions were intended to mirror the BINARY_ instructions, these
  mnemonics didn't match the BINARY_ ones, so the actual mnemonics are
  INPLACE_MODULO, INPLACE_LSHIFT and INPLACE_RSHIFT
* while at it, BINARY_ and INPLACE_ mnemonics: as noted above they're
  mirrors of one another with different prefixes (except for SUBSCR
  which doesn't have an INPLACE version), we only supported a fraction
  of the INPLACE codes for unknown reason.

  Initially looked at simply aligning the BINARY and INPLACE mnemonics
  e.g.

       'BINARY_POWER',  'BINARY_MULTIPLY',  'BINARY_FLOOR_DIVIDE',
      'INPLACE_POWER', 'INPLACE_MULTIPLY', 'INPLACE_FLOOR_DIVIDE',
      ...

  so it would be easier to notice discrepancies, but it seems simpler
  and clearer to just move the suffixes to a single list and generate
  the BINARY_ and INPLACE_ mnemonics from that
* moved STORE_SUBSCR from EXPR to SAFE, I don't see how `foo[...] = 3`
  could be in an expression
* remove pseudo-graylist `_POSSIBLE_OPCODES_P3`, was intended as a
  list of new P3 opcodes we might want to add, but the purpose was
  hard to understand and a proper blacklist makes way more sense

closes odoo/odoo#41085

Signed-off-by: Olivier Dony (odo) <odo@openerp.com>

0 files changed, 0 insertions, 0 deletions