From 4afcd0f1138a9646abdea876843e211742c8a505 Mon Sep 17 00:00:00 2001
From: Tal Leming <tal@typesupply.com>
Date: Thu, 29 Sep 2011 13:31:37 +0000
Subject: [PATCH] Lightly validate the contents of the kerning and groups
 during reading.

git-svn-id: http://svn.robofab.com/branches/ufo3k@335 b5fa9d6c-a76f-4ffd-b3cb-f825fc41095c
---
 Lib/ufoLib/__init__.py | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/Lib/ufoLib/__init__.py b/Lib/ufoLib/__init__.py
index f7e5e5ed8..c508078aa 100755
--- a/Lib/ufoLib/__init__.py
+++ b/Lib/ufoLib/__init__.py
@@ -239,8 +239,17 @@ class UFOReader(object):
 		if not self._checkForFile(path):
 			return {}
 		data = self._readPlist(path)
+		invalidFormatMessage = "groups.plist is not properly formatted."
 		if not isinstance(data, dict):
-			raise UFOLibError("groups.plist is not properly formatted.")
+			raise UFOLibError(invalidFormatMessage)
+		for groupName, glyphList in data.items():
+			if not isinstance(groupName, basestring):
+				raise UFOLibError(invalidFormatMessage)
+			elif not isinstance(glyphList, list):
+				raise UFOLibError(invalidFormatMessage)
+			for glyphName in glyphList:
+				if not isinstance(glyphName, basestring):
+					raise UFOLibError(invalidFormatMessage)
 		return data
 
 	def readGroups(self):
@@ -328,8 +337,19 @@ class UFOReader(object):
 		if not self._checkForFile(path):
 			return {}
 		data = self._readPlist(path)
+		invalidFormatMessage = "kerning.plist is not properly formatted."
 		if not isinstance(data, dict):
-			raise UFOLibError("kerning.plist is not properly formatted.")
+			raise UFOLibError(invalidFormatMessage)
+		for first, secondDict in data.items():
+			if not isinstance(first, basestring):
+				raise UFOLibError(invalidFormatMessage)
+			elif not isinstance(secondDict, dict):
+				raise UFOLibError(invalidFormatMessage)
+			for second, value in secondDict.items():
+				if not isinstance(second, basestring):
+					raise UFOLibError(invalidFormatMessage)
+				elif not isinstance(value, (int, float)):
+					raise UFOLibError(invalidFormatMessage)
 		return data
 
 	def readKerning(self):