eval

Find answer to string equation without using eval()

我与影子孤独终老i 提交于 2019-12-04 17:03:25
I need a way of taking an equation given as a string and finding it's mathematical answer, the big caveat is that I can't use eval(). I know the equation will only ever contain numbers, the four mathematical operators (i.e. * / + -) and parentheses, it may or may not have spaces in the string. Here's a couple of examples. 4 * 4 4+6/3 (3 / 2)*(4+8) (4+8) * 2 I'm guessing that it's going to have to be done with some kind of regex? Math expressions aren't regular. They're context-free . Your best bet is to parse them using well-known math parsing algorithms like the shunting yard algorithm . All

Inside a bash script, how to get PID from a program executed when using the eval command?

不想你离开。 提交于 2019-12-04 16:52:49
问题 I have commands in a bash script that are similar to this: eval "( java -classpath ./ $classname ${arguments[@]} $redirection_options $file )" & pid=$! However if I do a ps $pid it shows the main script process instead of the process of the java program. It obtains the correct process when I omit the eval, but in order to get some of the complicated arguments to work correctly I need to use it. Any idea of how I can get the PID of the java program when it's executed within an eval command?

Are ES6 template literals safer than eval?

不羁岁月 提交于 2019-12-04 16:00:18
问题 Template literals smell a bit like eval to me, and it's often cited that using eval is a bad idea. I'm not concerned with performance of template literals, but I am concerned about injection attacks (and other security concerns I may not be thinking of). Edit An example of something that feels odd to me let ii = 1; function counter() { return ii++; } console.log(`${counter()}, ${ii++}, ${counter()}`); Which outputs 1, 2, 3 The template literal is making side effects at the global level. Both

DBI: raiseerror in eval

对着背影说爱祢 提交于 2019-12-04 15:51:39
This question refers to this comment from Ikegami: [...] But if you're going to put an eval around every statement, just use RaiseError => 0. [...] in this thread . What do I gain, if I set RaiseError to 0 in such situations? #!/usr/bin/env perl use warnings; use 5.10.1; use DBI; my $db = 'my_test_sqlite_db.sqlite'; open my $fh, '>', $db or die $!; close $fh or die $!; my ( $dbh, $sth ); eval { $dbh = DBI->connect( "DBI:SQLite:dbname=$db", "", "", {} ); }; if ( $@ ) { print $@ }; my $table = 'my_sqlite_table'; say "RaiseError = 1"; say "PrintError = 0"; $dbh->{RaiseError} = 1; $dbh->

matlab中的eval函数使用

若如初见. 提交于 2019-12-04 15:37:39
matlab中的eval函数使用 在matlab的命令行窗口中输入help eval命令回车就可以看到eval函数的官方解释,大概的意思就是执行matlab中的表达式,计算expression表示的代码。意思是相当于在命令行中输入expression表达式命令的意思。 用法: eval(expression) [output1,…,outputN] = eval(expression) 这里就很奇怪了,为啥不直接在命令行中输入命令而是要多使用一个eval函数来完成这样的事情呢。这个是有原因的,下面举个例子: 1、比如你需要使用matlab加载一些数据,并且这些数据保存在很多个文件中,文件的命名有一定的规律,比如:data1.mat data2.mat......等,你需要怎样来加载呢?是直接写n个load data1.mat吗,显然不是的,当遇到这种情况的时候就是eval函数展示其用处的时候了。你可以这样写: for i = 1:n eval(['load',' ','data',num2str(i),'.mat']); % 这样完全跟上面的功能一样 end 2、当你需要在一串字符串中提取出数字,或者将一串十进制的数中将每个数都提取出来时,每个数字之间使用空格分开,即a = '12 34 45 67',这样的形式你怎样将他们提取出来变成一个矩阵呢

python程序的输入输出(input()/print()/eval())

时光毁灭记忆、已成空白 提交于 2019-12-04 15:09:21
python输入输出函数 1.输入函数input() 从控制台获取用户输入的函数 input()函数的使用格式: <变量>=input(<提示信息字符串>) 用户输入的信息以字符串类型保存在<变量>中,例如: TempStr=input("请输入")#TempStr保存用户输入的变量 2.输出函数print() 以字符形式向控制台输出结果的函数 print()函数的使用格式: print(<拟输出字符串或字符串变量>) 字符串类型的一对引号仅在程序内部使用,输出无引号 3.评估函数eval() eval()使用格式: eval(expression[, globals[, locals]])expression -- 表达式 globals -- 变量作用域,全局命名空间,如果被提供,则必须是一个字典对象 locals -- 变量作用域,局部命名空间,如果被提供,可以是任何映射对象 下面是eval()函数的一些用法: 来源: https://www.cnblogs.com/cyt99/p/11855538.html

Bind List of object array to ListView in ASP.NET

◇◆丶佛笑我妖孽 提交于 2019-12-04 13:10:53
I am breaking my head to fix an issue. I have a method that returns a List<Object[]> . Each object[] in the List contains the following: object[0]=Id; object[1]=Name; Now, I am looking for a way to bind this List to a ListView in a custom ItemTemplate which would look as follows: <asp:Label runat="server" ID="lblId" Text="Here want to do an Eval/Bind for object[0]"></asp:Label> <asp:Label runat="server" ID="lblName" Text="Here want to do an Eval/Bind for object[1]"></asp:Label> Any suggestions will be deeply appreciated. Your datasource is not capable for standard databinding. Convert it to a

disallow access to filesystem inside exec and eval in Python

倖福魔咒の 提交于 2019-12-04 12:39:57
I want to disallow access to file system from clients code, so I think I could overwrite open function env = { 'open': lambda *a: StringIO("you can't use open") } exec(open('user_code.py'), env) but I got this unqualified exec is not allowed in function 'my function' it contains a nested function with free variables I also try def open_exception(*a): raise Exception("you can't use open") env = { 'open': open_exception } but got the same Exception (not "you can't use open") I want to prevent of: executing this: """def foo(): return open('some_file').read() print foo()""" and evaluate this "open

php中无参函数的RCE

限于喜欢 提交于 2019-12-04 12:33:46
学习一下php中无符号的问题。 1.无参数 <?php if(';' === preg_replace('/[^\W]+\((?R)?\)/', '', $_GET['code'])) { eval($_GET['code']); } else { show_source(__FILE__); } ?> 这里调用函数只能是code(a()) 也就是括号中不能含有参数。 http-header传参 在session_id中设置我们想要输入的RCE,达到传参的目的,但是第一点需要session_start()开启session会话。 payload:code=eval(hex2bin(session_id(session_start()))); hex("phpinfo();")=706870696e666f28293b 可以成功命令执行。 第二种:post/get传入参数 get_defined_vars ( void ) : array 返回由所有已定义变量所组成的数组 此函数返回一个包含所有已定义变量列表的多维数组,这些变量包括环境变量、服务器变量和用户定义的变量。 payload:?code=var_dump(get_defined_vars())&b=1; 变量b和code都在参数中,如何将b带出来用它执行poc current ( array &$array ) :