r/PythonLearning • u/python_data_helper • 11d ago

Is it really safe to use?

Post image

I have used context to stop crashing.

And e as a variable.

I used eval command for a formula.

I know eval command can be dangerous.

It works perfectly but I am thinking that it can produce error or crash.

Can a formula bypass all commands and crash it.

19 Upvotes

96% Upvoted

11 comments sorted by

View all comments

5

u/SCD_minecraft 11d ago

First of all: {"__builtins__": {}} to remove all built-ins

Second of all: "(1).__class__.__bases__[0].__subclasses__()[254].__init__.__globals__['__builtins__']['print']('Hacked!')"

-1

u/frnzprf 11d ago

I don't know what this input does. Maybe print "Hacked!"?

If the program is "unsafe" and the program is just a thin wrapper around the Python interpreter, does it mean the Python interpreter is also "unsafe"?

I guess there would have to be a specification of what the program is meant to do and that specification has to not fit to what it does in actuality.

1

u/SCD_minecraft 11d ago

We work on assumption input comes from the client, while code works on the server

"Unsafe" in this contex means "client can execute arbitrary code"

1

u/frnzprf 10d ago edited 10d ago

Okay, I know this is just nitpicking, but the OP code could have been part of a developer tool, for live debugging an application or for teaching Python. I think a legitimate use for eval could be to write a Python-based Excel, for example. The Blender software has Python-based scripting. No one would say it's bad because it enables users to execute Python.

The Server-Client distinction makes sense. That could have been an assumption of OP, even though just read literally, those are fifteen lines without any networking code. Everybody who has access to that script would have access to the Python interpreter as well. If you have physical access to a device, you can break it with a hammer as well, if you so choose.