Hi,
I know that this issue has been discussed before, but most of
the time using only one argument to eval().
Is it possible to use the following code, e.g. run as part of a
web application, to break in and if so, how?
import math
def myeval(untrustedinput):
return eval(untrustedinput, {"__builtins__": None},
{ "abs": abs, "sin": math.sin })
Is it possible to define functions or import modules from the
untrusted input string?
Which Python built-ins and math functions would I have to add to
the functions dictionary to make it unsafe?
TIA! (Please cc me, thanks.)
--
http://mail.python.org/mailman/listinfo/python-list
