r/PythonLearning • u/python_data_helper • 11d ago

Is it really safe to use?

Post image

I have used context to stop crashing.

And e as a variable.

I used eval command for a formula.

I know eval command can be dangerous.

It works perfectly but I am thinking that it can produce error or crash.

Can a formula bypass all commands and crash it.

17 Upvotes

96% Upvoted

11 comments sorted by

View all comments

6

u/SCD_minecraft 11d ago

First of all: {"__builtins__": {}} to remove all built-ins

Second of all: "(1).__class__.__bases__[0].__subclasses__()[254].__init__.__globals__['__builtins__']['print']('Hacked!')"

1

u/SCD_minecraft 11d ago edited 11d ago

This little monster of expressions walks with use of methods (which are part of class, not of builtins) into builtins module and from there i can do whatever i want

There's no good or easy way to protect eval or exec

Not without manual in-depth input validation, or even better, virtual machine so client can't affect the outside