fix!: Move URL decorator to use entry point instead of eval

pyproject.toml

@@ -31,7 +31,7 @@ source = "vcs"
 
 [tool.pixi.project]
 channels = ["conda-forge", "bioconda"]
-platforms = ["linux-64", "osx-arm64"]
+platforms = ["linux-64", "osx-arm64", "osx-64"]
 
 [tool.pixi.dependencies]
 xrootd = ">=5.7.3,<6"

snakemake_storage_plugin_xrootd/__init__.py

@@ -2,6 +2,7 @@
 import os
 import re
 from typing import Any, Iterable, Optional, List, Type
+import importlib
 
 from reretry import retry
 
@@ -88,9 +89,9 @@ class StorageProviderSettings(StorageProviderSettingsBase):
         default=None,
         metadata={
             "help": (
-                "A Python expression (given as str) to decorate the URL (which is "
-                "available as variable `url` in the expression) e.g. to decorate it "
-                "with an auth token."
+                "Entry point to a function that expects a single string"
+                "argument (URL) and returns the decorated URL as a string,"
+                "e.g. `url_decorator='apd.snakemake:url_decorator'`."
             ),
             "env_var": False,
             "required": False,
@@ -129,10 +130,18 @@ def __post_init__(self):
             3031,
             3032,
         ]
+        self.dec_func = None
+        if self.settings.url_decorator is not None:
+            self.dec_func = self.load_decorator()
+
+    def load_decorator(self):
+        module_name, func_name = self.settings.url_decorator.split(":")
+        module = importlib.import_module(module_name)
+        return getattr(module, func_name)
 
     def url_decorator(self, url: str) -> str:
-        if self.settings.url_decorator is not None:
-            return eval(self.settings.url_decorator, {"url": url})
+        if self.dec_func is not None:
+            return self.dec_func(url)
         return url
 
     def _check_status(self, status: XRootDStatus, error_preamble: str):

tests/test_decorators.py

@@ -0,0 +1,3 @@
+# decorator must be a string with an importable function so put one here
+def add_decorator(url: str) -> str:
+    return url + "?authz=anonymous"

tests/tests.py

@@ -58,5 +58,5 @@ def get_storage_provider_settings(self) -> Optional[StorageProviderSettingsBase]
         return StorageProviderSettings(
             host="localhost",
             port=XROOTD_TEST_PORT,
-            url_decorator="url + '?authz=anonymous'",
+            url_decorator="test_decorators:add_decorator",
         )