On 2013-01-04, Tim Chase <python.l...@tim.thechases.com> wrote:
> On 01/03/13 17:25, Grant Edwards wrote:
>> def lessDangerousEval(expr):
>> global symbolTable
>> if 'import' in expr:
>> raise ParseError("operand expressions are not allowed to contain
>> the string 'import'")
>> globals = {'__builtins__': None}
>> locals = symbolTable
>> return eval(expr, globals, locals)
>>
>> I can guarantee that symbolTable is a dict that maps a set of string
>> symbol names to integer values.
>
> For what definition of "safe"? Are CPython segfaults a problem?
Not by themselves, no.
> Blowing the stack?
Not a problem either. I don't care if the program crashes. It's a
pretty dumb assembler, and it gives up and exits after the first error
anyway.
> Do you aim to prevent exploitable things like system calls or
> network/file access?
Yes, that's mainly what I was wondering wondering about.
--
Grant
--
http://mail.python.org/mailman/listinfo/python-list
