From dc68210afc8f9afdd702629efd9ad6b8d49fa920 Mon Sep 17 00:00:00 2001
From: xsser <xsser@users.noreply.github.com>
Date: Wed, 13 Mar 2024 22:31:08 +0800
Subject: [PATCH] Update newsevent.py security problem
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

源版本中的eval函数可能可以被绕过， 如果新闻数据输入一些饮用__import__内置的函数可能导致执行任何命令。使用任何使用tushare的用户遭受RCE攻击。ps：能给我一个token么- - ！
---
 tushare/stock/newsevent.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/tushare/stock/newsevent.py b/tushare/stock/newsevent.py
index 0b57aa14..b7e311bd 100644
--- a/tushare/stock/newsevent.py
+++ b/tushare/stock/newsevent.py
@@ -49,8 +49,7 @@ def get_latest_news(top=None, show_content=False):
         data_str = urlopen(request, timeout=10).read()
         data_str = data_str.decode('GBK')
         data_str = data_str.split('=')[1][:-1]
-        data_str = eval(data_str, type('Dummy', (dict,), 
-                                       dict(__getitem__ = lambda s, n:n))())
+        data_str = data_str = eval(data_str, {"__builtins__": {}}, {"Dummy": type("Dummy", (dict,), {"__getitem__": lambda s, n: n})})
         data_str = json.dumps(data_str)
         data_str = json.loads(data_str)
         data_str = data_str['list']