fix a hole in sandboxing allowing builtin file to write outside of the sandbox

--HG--
branch : distribute
extra : rebase_source : 5ff181b30f41080ec0e0628c96abf270ffe1a730

1 files changed, 6 insertions, 0 deletions

diff --git a/setuptools/sandbox.py b/setuptools/sandbox.py
index 67cedde6..7b487833 100755
--- a/setuptools/sandbox.py
+++ b/setuptools/sandbox.py
@@ -168,6 +168,12 @@ class DirectorySandbox(AbstractSandbox):
     def _violation(self, operation, *args, **kw):
         raise SandboxViolation(operation, args, kw)
 
+    if _file:
+        def _file(self, path, mode='r', *args, **kw):
+            if mode not in ('r', 'rt', 'rb', 'rU', 'U') and not self._ok(path):
+                self._violation("file", path, mode, *args, **kw)
+            return _file(path,mode,*args,**kw)
+
     def _open(self, path, mode='r', *args, **kw):
         if mode not in ('r', 'rt', 'rb', 'rU', 'U') and not self._ok(path):
             self._violation("open", path, mode, *args, **kw)