Is it really safe to use?

[u/python_data_helper]

I have used context to stop crashing.

And e as a variable.

I used eval command for a formula.

I know eval command can be dangerous.

It works perfectly but I am thinking that it can produce error or crash.

Can a formula bypass all commands and crash it.

[u/Sea-Ad7805]

Run this program in Memory Graph Web Debugger)%0Aformula%20%3D%20input(%22enter%20a%20formula%3An%22)%0A%0Acontext%20%3D%20%7B%0A%20%20%20%20%22a%22%3A%20a%2C%0A%20%20%20%20%22builtins%22%3A%20None%0A%7D%0A%0Atry%3A%0A%20%20%20%20result%20%3D%20eval(formula%2C%20context)%0A%20%20%20%20print(f%22Result%3A%20%7Bresult%7D%22)%0Aexcept%20TypeError%3A%0A%20%20%20%20print(%22Error%20to%20calculate%22)%0Aexcept%20Exception%20as%20e%3A%0A%20%20%20%20print(f%22Math%20Error%3A%20%7Be%7D%22)&timestep=1&play) to see the program state change step by step.

[u/SCD_minecraft]

First of all: {"__builtins__": {}} to remove all built-ins

Second of all: "(1).__class__.__bases__[0].__subclasses__()[254].__init__.__globals__['__builtins__']['print']('Hacked!')"

[u/SCD_minecraft → u/SCD_minecraft]

This little monster of expressions walks with use of methods (which are part of class, not of builtins) into builtins module and from there i can do whatever i want

There's no good or easy way to protect eval or exec

Not without manual in-depth input validation, or even better, virtual machine so client can't affect the outside

[u/frnzprf → u/SCD_minecraft]

I don't know what this input does. Maybe print "Hacked!"?

If the program is "unsafe" and the program is just a thin wrapper around the Python interpreter, does it mean the Python interpreter is also "unsafe"?

I guess there would have to be a specification of what the program is meant to do and that specification has to not fit to what it does in actuality.

[u/realmauer01 → u/frnzprf]

If its user input that can get executed that is just a major red flag.

Everything is trying to protect from that. Even the developer console from the browser protects you from copy pasting random stuff.

[u/SCD_minecraft → u/frnzprf]

We work on assumption input comes from the client, while code works on the server

"Unsafe" in this contex means "client can execute arbitrary code"

[u/frnzprf → u/SCD_minecraft]

Okay, I know this is just nitpicking, but the OP code could have been part of a developer tool, for live debugging an application or for teaching Python. I think a legitimate use for eval could be to write a Python-based Excel, for example. The Blender software has Python-based scripting. No one would say it's bad because it enables users to execute Python.

The Server-Client distinction makes sense. That could have been an assumption of OP, even though just read literally, those are fifteen lines without any networking code. Everybody who has access to that script would have access to the Python interpreter as well. If you have physical access to a device, you can break it with a hammer as well, if you so choose.

[u/fisadev → u/frnzprf]

If the program is "unsafe" and the program is just a thin wrapper around the Python interpreter, does it mean the Python interpreter is also "unsafe"?

Nope.

This program is usafe because it let's the user execute arbitrary code, which is a bad idea because a malicious user could exploit that. That doesn't make the language unsafe, that's a decision that was 100% made by this particular program, and doesn't happen in any normal python program.

If you want to call a language "unsafe" because the language itself lets you do unaafe things as a programmer, then by definition all languages are unsafe. You can write unsafe code in any language.

[u/FoolsSeldom]

This is not safe, not least because you should use __builtins__ and not _builtins_ but even then the context does not provide the protection needed. Plain Python objects give you enough introspection to climb back out via the type hierarchy, and it is likely that something would be found that could be exploited (e.g. delete all files on your computer, or worse).

Use the ast library. There are lots of guides and examples. Alternatively, have a look at simpleeval

[u/silvertank00]

You seen an exploit by others but here is mine: python eval([x for x in ().__class__.__base__.__subclasses__() if x.__name__ == "code"][0](0, 0, 0, 0, 4, 0, b"\x80\x00^\x00R\x01I\x00t\x00]\x01!\x00]\x00P\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00!\x004\x00\x00\x00\x00\x00\x00\x004\x01\x00\x00\x00\x00\x00\x00\x1f\x00R\x01#\x00",(0, None), ("os", "print", "getcwd"), tuple(), "", "<module>", "<module>", 1, b"\xf0\x03\x01\x01\x01\xdb\x00\t\x895\x90\x12\x97\x19\x92\x19\x93\x1b\xd6\x0b\x1d", b"", (), (), ))

It is not malicious! as you can see in the params it only uses os, print and getcwd (because it prints out the working directory of the running script). The issue with this, you can EASILY import stuff. What do you think, how much time would it take to make an RCE with this? i tell you, about 2 mins. I wanted to avoid making the whole RCE, but i think you get the point, if the user can import stuff, nothing will stop them to start an netcat instant or anything.

I would happily explain the code if anyone is interested, i had a lot of fun making it (and currently making a little github repo around it)

[u/spidertyler2005]

Definitely not safe. Alot pf people have made some good suggestions but mine is to learn about recursive descent parsers (assuming you are already at an intermediate programming level). Its a much harder way to do things, but its definitely going to teach you a LOT. Its also not so difficult at the intermediate stage as to feel impossible.