eval

Safety of Python 'eval' For List Deserialization

£可爱£侵袭症+ 提交于 2019-11-26 21:06:00
问题 Are there any security exploits that could occur in this scenario: eval(repr(unsanitized_user_input), {"__builtins__": None}, {"True":True, "False":False}) where unsanitized_user_input is a str object. The string is user-generated and could be nasty. Assuming our web framework hasn't failed us, it's a real honest-to-god str instance from the Python builtins. If this is dangerous, can we do anything to the input to make it safe? We definitely don't want to execute anything contained in the

如何将Windows Server 2019/2016评估升级到完整版?

喜夏-厌秋 提交于 2019-11-26 20:48:13
如果您已经安装 的Windows Server 2019 / Windows的服务器2016 StandardEvaluation 或 DatacenterEvaluation 版试用微软服务器平台的新功能(你可以下载的Windows Server 2019免费试用或Windows Server 2016评估 这里 注册后),可以获得180天试用时间, 在此期间,可以使用Windows Server 2019/2016的所有功能。 有一种方法可以使用以下命令将Windows Server评估期延长180天: slmgr /rearm 我们可以将Windows Server试用期延长最多5次。 因此,Windows Server免费试用版的最长生命周期可以延长 至3年 = 180天* 6(但是,根据使用Microsoft的评估版本的条款,您不应将试用版用于商业用途)。 Windows Server评估的升级限制 在将Windows Server Evaluation转换为完整版之前,您需要了解一些升级限制: 只能转换Windows Server的完整GUI版本。 Server Core或Nano Server无法以这种方式转换; 无法升级具有域控制器角色的服务器(Active Directory域服务角色)。 必须降级DC并首先卸载此角色; 它无法从Windows Server

Linux eval命令

江枫思渺然 提交于 2019-11-26 20:33:05
1、eval命令将会首先扫描命令行进行所有的替换,再执行命令。该命令使用于那些一次扫描无法实现其功能的变量。该命令对变量进行两次扫描。这些需要进行两次扫描的变量有时候被称为复杂变量。 2、eval也可以用于回显简单变量,不一定时复杂变量。 [ root@node2 mysql ] # NAME = ZONE [ root@node2 mysql ] # eval echo $NAME ZONE -- --等价于 [ root@node2 mysql ] # echo $NAME ZONE 3、两次扫描 [ root@node2 app ] # cat test.txt hello shell world! [ root@node2 app ] # myfile = "cat test.txt" ( 1 ) [ root@node2 app ] # echo $myfile cat test.txt ( 2 ) [ root@node2 app ] # eval echo $($myfile) hello shell world! 从(2)可以知道第一次扫描进行了变量替换,第二次扫描执行了该字符串中所包含的命令。 4、获得最后一个参数 [ root@node2 app ] # echo "Last argument is $(eval echo \$$#)" Last

Eval is evil… So what should I use instead?

扶醉桌前 提交于 2019-11-26 20:21:15
An ajax request returns me a standard JSON array filled with my user's inputs. The input has been sanitized, and using the eval() function, I can easily create my javascript object and update my page... So here's the problem. No matter how hard I try to sanitize the inputs, I'd rather not use the eval() function. I've checked google for ways to use "JSON in AJAX without eval" and have ran accross a bunch of different methods... Which one should I use? Is there a standard, proven-secure way of doing this? json.org has a nice javascript library simple usage: JSON.parse('[{"some":"json"}]'); JSON

temp

核能气质少年 提交于 2019-11-26 20:10:16
QueryResult.h、TextQuery.h、TextQuery.cpp 和 make_plural.h 同 练习 12.27 。 Query.h #ifndef TEST_QUERY_H #define TEST_QUERY_H #include "TextQuery.h" #include <string> #include <set> #include <iostream> #include <fstream> #include <sstream> #include <memory> // abstract class acts as a base class for concrete query types; all members are private class Query_base { friend class Query; protected: typedef TextQuery::line_no line_no; // used in the eval functions virtual ~Query_base() {} private: // eval returns the QueryResult that matches this Query virtual QueryResult eval(const TextQuery &) const = 0;

Evaluate math equations from unsafe user input in Python

喜夏-厌秋 提交于 2019-11-26 20:09:07
问题 I have a website where the user enters math equations (expressions) and then those equations are evaluated against data (constants) provided by the website. The math operations needed include symbols, arithmetic operations, min() , max() and some other basic functions. A sample equation could be: max(a * b + 100, a / b - 200) One could simply eval() this using Python, but as we all know this leads compromising the site. What would be the safe approach of doing math equation evaluation? What

Python: How can I run eval() in the local scope of a function

三世轮回 提交于 2019-11-26 19:11:53
I try to use eval() in a local scope of a function. However it always evaluate in the global scope. Self contained examples: 1- This code works: var1 = 1 var2 = 2 var3 = 3 myDict = dict((name, eval(name)) for name in ["var1", "var2", "var3"]) print(myDict["var1"]) 2- Throws NameError for lvar1 def test1(): lvar1 = 1 lvar2 = 2 lvar3 = 3 myDict = dict((name, eval(name)) for name in ["lvar1", "lvar2", "lvar3"]) print(myDict["lvar1"]) 3- Same outcome as 2. def test2(): lvar1 = 1 lvar2 = 2 lvar3 = 3 myDict = dict((name, eval(name), locals()) for name in ["lvar1", "lvar2", "lvar3"]) print(myDict[

Execute PHP code in a string [duplicate]

时光毁灭记忆、已成空白 提交于 2019-11-26 19:05:44
This question already has an answer here: PHP eval issue with PHP + HTML code 5 answers I have my page contents saved in a database and would like to execute any php code in the string. So if my string was: <h1>Welcome</h1><?php echo $motto?><br/> I only want to execute echo $motto . Using eval() will try to execute <h1>Welcome</h1> . Any way to do this? Needless to say you should find another solution ASAP. In the meantime you can eval the code like this: $str = '<h1>Welcome</h1><?php echo $motto?><br/>'; // Your DB content eval("?> $str <?php "); Demo: http://codepad.org/ao2PPHN7 I can't

格式化数据和DataBinder.Eval用法范例【转】

岁酱吖の 提交于 2019-11-26 19:04:48
DataBinder.Eval 它带有三个参数:数据项的命名容器、数据字段名称和格式化字符串。 在模板列表如DataList、DataGrid、或 Repeater,命名容器总是Container.DataItem。 Page 是另一个可以被DataBinder.Eval使用的命名容器。 <%# DataBinder.Eval(Container.DataItem, "IntegerValue", "{0:c}") %> 格式化字符串参数是可选的。如果忽略参数,DataBinder.Eval 返回对象类型的值, //显示二位小数 //<%# DataBinder.Eval(Container.DataItem, "UnitPrice", "${0:F2}") %> //{0:G}代表显示True或False //<ItemTemplate> // <asp:Image Width="12" Height="12" Border="0" runat="server" // AlternateText='<%# DataBinder.Eval(Container.DataItem, "Discontinued", "{0:G}") %>' // ImageUrl='<%# DataBinder.Eval(Container.DataItem, "Discontinued", "~

Restricting eval() to a narrow scope

本秂侑毒 提交于 2019-11-26 18:52:11
I have a javascript file that reads another file which may contain javascript fragments that need to be eval()-ed. The script fragments are supposed to conform to a strict subset of javascript that limits what they can do and which variables they can change, but I want to know if there is some way to enforce this by preventing the eval from seeing variables in the global scope. Something like the following: function safeEval( fragment ) { var localVariable = g_Variable; { // do magic scoping here so that the eval fragment can see localVariable // but not g_Variable or anything else outside