#!/usr/bin/env python

###############################################################################
# Copyright 2017 The Apollo Authors. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
###############################################################################
"""SocketIO API."""
import google.protobuf.json_format as json_format

from config import Config
from modules.hmi.proto.hmi_message_pb2 import SocketIORequest
import hardware_api
import module_api
import ros_bridge_api
import tool_api

class SocketIOApi(object):
    """
    Socket IO API, which delegate request to target api, and broadcast result
    all HMI frontends.
    """
    API = {
        'hardware_api': hardware_api.HardwareApi,
        'module_api': module_api.ModuleApi,
        'ros_bridge_api': ros_bridge_api.RosBridgeApi,
        'tool_api': tool_api.ToolApi,
    }

    @classmethod
    def execute(cls, socketio_request_json):
        """Execute a command on the given API."""
        Config.log.info('SocketIOApi::execute %s', socketio_request_json)
        socketio_request = json_format.ParseDict(socketio_request_json,
                                                 SocketIORequest())

        api = cls.API.get(socketio_request.api_name)
        if api is None:
            Config.log.critical('Cannot find %s', socketio_request.api_name)
            return
        cmd = eval('api.' + socketio_request.command_name)
        cmd(*socketio_request.args)

@@ -1757,19 +1757,53 @@
  if 
-api is None
+socketio_request.command_name not in dir(api)
 :%0A  
@@ -1845,16 +1845,19 @@
 ot find 
+%25s.
 %25s', soc
@@ -1870,32 +1870,95 @@
 request.api_name
+,%0A                                socketio_request.command_name
 )%0A            re

Fix vulnerability of code injection via socketio request. (#857)