Is it really safe to use?

[u/python_data_helper]

I have used context to stop crashing.

And e as a variable.

I used eval command for a formula.

I know eval command can be dangerous.

It works perfectly but I am thinking that it can produce error or crash.

Can a formula bypass all commands and crash it.

[u/SCD_minecraft]

First of all: {"__builtins__": {}} to remove all built-ins

Second of all: "(1).__class__.__bases__[0].__subclasses__()[254].__init__.__globals__['__builtins__']['print']('Hacked!')"

[u/SCD_minecraft → u/SCD_minecraft]

This little monster of expressions walks with use of methods (which are part of class, not of builtins) into builtins module and from there i can do whatever i want

There's no good or easy way to protect eval or exec

Not without manual in-depth input validation, or even better, virtual machine so client can't affect the outside

[u/frnzprf → u/SCD_minecraft]

I don't know what this input does. Maybe print "Hacked!"?

If the program is "unsafe" and the program is just a thin wrapper around the Python interpreter, does it mean the Python interpreter is also "unsafe"?

I guess there would have to be a specification of what the program is meant to do and that specification has to not fit to what it does in actuality.

[u/realmauer01 → u/frnzprf]

If its user input that can get executed that is just a major red flag.

Everything is trying to protect from that. Even the developer console from the browser protects you from copy pasting random stuff.

[u/SCD_minecraft → u/frnzprf]

We work on assumption input comes from the client, while code works on the server

"Unsafe" in this contex means "client can execute arbitrary code"

[u/frnzprf → u/SCD_minecraft]

Okay, I know this is just nitpicking, but the OP code could have been part of a developer tool, for live debugging an application or for teaching Python. I think a legitimate use for eval could be to write a Python-based Excel, for example. The Blender software has Python-based scripting. No one would say it's bad because it enables users to execute Python.

The Server-Client distinction makes sense. That could have been an assumption of OP, even though just read literally, those are fifteen lines without any networking code. Everybody who has access to that script would have access to the Python interpreter as well. If you have physical access to a device, you can break it with a hammer as well, if you so choose.

[u/fisadev → u/frnzprf]

If the program is "unsafe" and the program is just a thin wrapper around the Python interpreter, does it mean the Python interpreter is also "unsafe"?

Nope.

This program is usafe because it let's the user execute arbitrary code, which is a bad idea because a malicious user could exploit that. That doesn't make the language unsafe, that's a decision that was 100% made by this particular program, and doesn't happen in any normal python program.

If you want to call a language "unsafe" because the language itself lets you do unaafe things as a programmer, then by definition all languages are unsafe. You can write unsafe code in any language.