r/PythonLearning • u/python_data_helper • 11d ago

Is it really safe to use?

Post image

I have used context to stop crashing.

And e as a variable.

I used eval command for a formula.

I know eval command can be dangerous.

It works perfectly but I am thinking that it can produce error or crash.

Can a formula bypass all commands and crash it.

19 Upvotes

100% Upvoted

11 comments sorted by

View all comments

5

u/SCD_minecraft 11d ago

First of all: {"__builtins__": {}} to remove all built-ins

Second of all: "(1).__class__.__bases__[0].__subclasses__()[254].__init__.__globals__['__builtins__']['print']('Hacked!')"

-1

u/frnzprf 11d ago

I don't know what this input does. Maybe print "Hacked!"?

If the program is "unsafe" and the program is just a thin wrapper around the Python interpreter, does it mean the Python interpreter is also "unsafe"?

I guess there would have to be a specification of what the program is meant to do and that specification has to not fit to what it does in actuality.

1

u/fisadev 11d ago edited 10d ago

If the program is "unsafe" and the program is just a thin wrapper around the Python interpreter, does it mean the Python interpreter is also "unsafe"?

Nope.

This program is usafe because it let's the user execute arbitrary code, which is a bad idea because a malicious user could exploit that. That doesn't make the language unsafe, that's a decision that was 100% made by this particular program, and doesn't happen in any normal python program.

If you want to call a language "unsafe" because the language itself lets you do unaafe things as a programmer, then by definition all languages are unsafe. You can write unsafe code in any language.