How safe is expression evaluation using eval?

前端 未结 3 1641
迷失自我
迷失自我 2020-12-10 08:33

I am building a website where I have a need that user should be able to evaluate some expression based from the value in DB tables, instead of using tools like pyparsing etc

3条回答
  •  粉色の甜心
    2020-12-10 08:52

    It is possible to get create and invoke any class defined in the program, which includes ones that can exit the Python interpreter. In addition, you can create and execute arbitrary strings of bytecode, which can segfault the interpreter. See Eval really is dangerous for all the details.

提交回复
热议问题