Security: eval() used to parse gateway response in helpers/tools.py (arbitrary code execution)

[DjuOuiddoo]

Summary

helpers/tools.py parses the payment gateway response (IPN/return payload) with eval() instead of json.loads(). That payload reaches the server over HTTP, so evaluating it as Python code exposes the payment path to arbitrary code execution (CWE-95).

Affected code

Seen in current versions (e.g. 4.3.1), several functions in helpers/tools.py do:

answer = eval(json.dumps(post, ensure_ascii=False)).get("kr-answer")
order_cycle = eval(answer).get('orderCycle')

eval(json.dumps(post, ...)) is an identity round-trip over a dict, and eval(answer) evaluates the raw kr-answer string from the request. The module even defines null/true/false globals so eval() can parse JSON literals — a clear sign json.loads() was intended.

Impact

Any value reaching these functions is executed as Python. On the payment return/IPN path this is a code-injection sink.

Suggested fix

• eval(json.dumps(post, ...)) → direct dict access on post
• eval(answer) → json.loads(answer)
• remove the null/true/false globals
• use hmac.compare_digest() in check_hash() (constant-time)

Behavior-preserving. We run this fix in production and will open a PR against develop.

[DjuOuiddoo]

Here's the full patch we run in production (drop-in for helpers/tools.py):

• remove the module-level null / true / false globals (only needed by eval)

• eval(json.dumps(post, ensure_ascii=False)) → post (all occurrences)

• eval(answer) → json.loads(answer) (all occurrences)

• rewrite check_hash():

  def check_hash(post, key):
  expected = hmac.new(
  key.encode("utf-8"),
  post.get("kr-answer").encode("utf-8"),
  hashlib.sha256,
  ).hexdigest()
  return hmac.compare_digest(expected, post.get("kr-hash") or "")

Behavior-preserving, no functional change. Happy to open a PR against develop if a maintainer can enable that, otherwise feel free to apply directly.