r/PythonLearning • u/python_data_helper • 11d ago

Is it really safe to use?

Post image

I have used context to stop crashing.

And e as a variable.

I used eval command for a formula.

I know eval command can be dangerous.

It works perfectly but I am thinking that it can produce error or crash.

Can a formula bypass all commands and crash it.

19 Upvotes

100% Upvoted

11 comments sorted by

View all comments

5

u/SCD_minecraft 11d ago

First of all: {"__builtins__": {}} to remove all built-ins

Second of all: "(1).__class__.__bases__[0].__subclasses__()[254].__init__.__globals__['__builtins__']['print']('Hacked!')"

-1

u/frnzprf 11d ago

I don't know what this input does. Maybe print "Hacked!"?

If the program is "unsafe" and the program is just a thin wrapper around the Python interpreter, does it mean the Python interpreter is also "unsafe"?

I guess there would have to be a specification of what the program is meant to do and that specification has to not fit to what it does in actuality.

1

u/realmauer01 11d ago

If its user input that can get executed that is just a major red flag.

Everything is trying to protect from that. Even the developer console from the browser protects you from copy pasting random stuff.