Safety of Python 'eval' For List Deserialization
问题 Are there any security exploits that could occur in this scenario: eval(repr(unsanitized_user_input), {"__builtins__": None}, {"True":True, "False":False}) where unsanitized_user_input is a str object. The string is user-generated and could be nasty. Assuming our web framework hasn't failed us, it's a real honest-to-god str instance from the Python builtins. If this is dangerous, can we do anything to the input to make it safe? We definitely don't want to execute anything contained in the