Python: make eval safe

python eval
flybywire picture flybywire · Aug 18, 2010 · Viewed 31.7k times · Source

I want an easy way to do a "calculator API" in Python.

Right now I don't care much about the exact set of features the calculator is going to support.

I want it to receive a string, say "1+1" and return a string with the result, in our case "2".

Is there a way to make eval safe for such a thing?

For a start I would do 

env = {}
env["locals"]   = None
env["globals"]  = None
env["__name__"] = None
env["__file__"] = None
env["__builtins__"] = None

eval(users_str, env)

so that the caller cannot mess with my local variables (or see them).

But I am sure I am overseeing a lot here.

Are eval's security issues fixable or are there just too many tiny details to get it working right?

Answer

Alex Martelli picture Alex Martelli · Aug 18, 2010

are eval's security issues fixable or are there just too many tiny details to get it working right?

Definitely the latter -- a clever hacker will always manage to find a way around your precautions.

If you're satisfied with plain expressions using elementary-type literals only, use ast.literal_eval -- that's what it's for! For anything fancier, I recommend a parsing package, such as ply if you're familiar and comfortable with the classic lexx/yacc approach, or pyparsing for a possibly more Pythonic approach.

Related questions

What does Python's eval() do?

In the book that I am reading on Python, it keeps using the code eval(input('blah')) I read the documentation, and I understand it, but I still do not see how it changes the input() function. What does it …

Read More
What's the difference between eval, exec, and compile?

I've been looking at dynamic evaluation of Python code, and come across the eval() and compile() functions, and the exec statement. Can someone please explain the difference between eval and exec, and how the different modes of compile() fit in?

Read More
Using python's eval() vs. ast.literal_eval()?

I have a situation with some code where eval() came up as a possible solution. Now I have never had to use eval() before but, I have come across plenty of information about the potential danger it can cause. That …

Read More