Re: Yet another attempt at a safe eval() call

2013-03-14 Thread Ken Seehart
On 1/4/2013 5:33 AM, Steven D'Aprano wrote: > On Fri, 04 Jan 2013 07:24:04 -0500, Terry Reedy wrote: > >> On 1/3/2013 6:25 PM, Grant Edwards wrote: >>> I've written a small assembler in Python 2.[67], and it needs to >>> evaluate integer-valued arithmetic expressions in the context of a >>> symbol

Re: Yet another attempt at a safe eval() call

2013-01-06 Thread Oscar Benjamin
On 6 January 2013 15:12, Grant Edwards wrote: > On 2013-01-05, Oscar Benjamin wrote: >> On 4 January 2013 15:53, Grant Edwards wrote: >>> On 2013-01-04, Steven D'Aprano wrote: On Thu, 03 Jan 2013 23:25:51 +, Grant Edwards wrote: * But frankly, you should avoid eval, and write

Re: Yet another attempt at a safe eval() call

2013-01-06 Thread Grant Edwards
On 2013-01-05, Oscar Benjamin wrote: > On 4 January 2013 15:53, Grant Edwards wrote: >> On 2013-01-04, Steven D'Aprano wrote: >>> On Thu, 03 Jan 2013 23:25:51 +, Grant Edwards wrote: >>> >>> * But frankly, you should avoid eval, and write your own mini-integer >>> arithmetic evaluator whic

Re: Yet another attempt at a safe eval() call

2013-01-05 Thread matt . newville
On Saturday, January 5, 2013 8:17:16 AM UTC-8, Oscar Benjamin wrote: > On 5 January 2013 16:01, Chris Angelico wrote: > > > On Sun, Jan 6, 2013 at 2:56 AM, Oscar Benjamin > > > wrote: > > >> On 4 January 2013 15:53, Grant Edwards wrote: > > >>> On 2013-01-04, Steven D'Aprano > >>> wrote: >

Re: Yet another attempt at a safe eval() call

2013-01-05 Thread Oscar Benjamin
On 5 January 2013 16:01, Chris Angelico wrote: > On Sun, Jan 6, 2013 at 2:56 AM, Oscar Benjamin > wrote: >> On 4 January 2013 15:53, Grant Edwards wrote: >>> On 2013-01-04, Steven D'Aprano wrote: On Thu, 03 Jan 2013 23:25:51 +, Grant Edwards wrote: * But frankly, you should a

Re: Yet another attempt at a safe eval() call

2013-01-05 Thread Chris Angelico
On Sun, Jan 6, 2013 at 2:56 AM, Oscar Benjamin wrote: > On 4 January 2013 15:53, Grant Edwards wrote: >> On 2013-01-04, Steven D'Aprano wrote: >>> On Thu, 03 Jan 2013 23:25:51 +, Grant Edwards wrote: >>> >>> * But frankly, you should avoid eval, and write your own mini-integer >>> arithmet

Re: Yet another attempt at a safe eval() call

2013-01-05 Thread Oscar Benjamin
On 4 January 2013 15:53, Grant Edwards wrote: > On 2013-01-04, Steven D'Aprano wrote: >> On Thu, 03 Jan 2013 23:25:51 +, Grant Edwards wrote: >> >> * But frankly, you should avoid eval, and write your own mini-integer >> arithmetic evaluator which avoids even the most remote possibility >>

Re: Yet another attempt at a safe eval() call

2013-01-04 Thread Chris Angelico
On Sat, Jan 5, 2013 at 5:43 AM, Grant Edwards wrote: > On 2013-01-04, Chris Angelico wrote: >> On Sat, Jan 5, 2013 at 5:09 AM, Grant Edwards >> wrote: >>> The error messages are still pretty cryptic, so improving >>> that will add a few more lines. One nice thing about the ast code is >>> that

Re: Yet another attempt at a safe eval() call

2013-01-04 Thread Grant Edwards
On 2013-01-04, Chris Angelico wrote: > On Sat, Jan 5, 2013 at 5:09 AM, Grant Edwards wrote: >> The error messages are still pretty cryptic, so improving >> that will add a few more lines. One nice thing about the ast code is >> that it's simple to add code to allow C-like character constants suc

Re: Yet another attempt at a safe eval() call

2013-01-04 Thread Chris Angelico
On Sat, Jan 5, 2013 at 5:09 AM, Grant Edwards wrote: > The error messages are still pretty cryptic, so improving > that will add a few more lines. One nice thing about the ast code is > that it's simple to add code to allow C-like character constants such > that ('A' === 0x41). Here's the first

Re: Yet another attempt at a safe eval() call

2013-01-04 Thread Alister
On Fri, 04 Jan 2013 13:33:41 +, Steven D'Aprano wrote: > On Fri, 04 Jan 2013 07:24:04 -0500, Terry Reedy wrote: > >> On 1/3/2013 6:25 PM, Grant Edwards wrote: >>> >>> I've written a small assembler in Python 2.[67], and it needs to >>> evaluate integer-valued arithmetic expressions in the con

Re: Yet another attempt at a safe eval() call

2013-01-04 Thread Grant Edwards
On 2013-01-04, Chris Angelico wrote: > On Sat, Jan 5, 2013 at 4:14 AM, Grant Edwards wrote: >> On 2013-01-04, Chris Angelico wrote: >>> On Sat, Jan 5, 2013 at 3:38 AM, Grant Edwards >>> wrote: >> I've added equals, backslash, commas, square/curly brackets, colons and semicolons to th

Re: Yet another attempt at a safe eval() call

2013-01-04 Thread Chris Angelico
On Sat, Jan 5, 2013 at 4:14 AM, Grant Edwards wrote: > On 2013-01-04, Chris Angelico wrote: >> On Sat, Jan 5, 2013 at 3:38 AM, Grant Edwards >> wrote: > >>> I've added equals, backslash, commas, square/curly brackets, colons >>> and semicolons to the prohibited character list. I also reduced th

Re: Yet another attempt at a safe eval() call

2013-01-04 Thread Grant Edwards
On 2013-01-04, Chris Angelico wrote: > On Sat, Jan 5, 2013 at 3:38 AM, Grant Edwards wrote: >> I've added equals, backslash, commas, square/curly brackets, colons >> and semicolons to the prohibited character list. I also reduced the >> maximum length to 60 characters. It's unfortunate that par

Re: Yet another attempt at a safe eval() call

2013-01-04 Thread Chris Angelico
On Sat, Jan 5, 2013 at 3:38 AM, Grant Edwards wrote: > I've added equals, backslash, commas, square/curly brackets, colons and > semicolons to the > prohibited character list. I also reduced the maximum length to 60 > characters. It's unfortunate that parentheses are overloaded for both > expres

Re: Yet another attempt at a safe eval() call

2013-01-04 Thread Grant Edwards
On 2013-01-04, Steven D'Aprano wrote: > On Thu, 03 Jan 2013 23:25:51 +, Grant Edwards wrote: > >> I've written a small assembler in Python 2.[67], and it needs to >> evaluate integer-valued arithmetic expressions in the context of a >> symbol table that defines integer values for a set of name

Re: Yet another attempt at a safe eval() call

2013-01-04 Thread Grant Edwards
On 2013-01-04, Michael Torrie wrote: > On 01/04/2013 08:53 AM, Grant Edwards wrote: >> That's obviously the "right" thing to do. I suppose I should figure >> out how to use the ast module. > > Or PyParsing. > > As for your program being "secure" I don't see that there's much to > exploit. Ther

Re: Yet another attempt at a safe eval() call

2013-01-04 Thread Michael Torrie
On 01/04/2013 08:53 AM, Grant Edwards wrote: > That's obviously the "right" thing to do. I suppose I should figure > out how to use the ast module. Or PyParsing. As for your program being "secure" I don't see that there's much to exploit. You're not running as a service, and you're not runnin

Re: Yet another attempt at a safe eval() call

2013-01-04 Thread Grant Edwards
On 2013-01-04, Steven D'Aprano wrote: > On Fri, 04 Jan 2013 07:24:04 -0500, Terry Reedy wrote: > >> On 1/3/2013 6:25 PM, Grant Edwards wrote: >>> >>> I've written a small assembler in Python 2.[67], and it needs to >>> evaluate integer-valued arithmetic expressions in the context of a >>> symbol t

Re: Yet another attempt at a safe eval() call

2013-01-04 Thread Grant Edwards
On 2013-01-04, Steven D'Aprano wrote: > On Thu, 03 Jan 2013 23:25:51 +, Grant Edwards wrote: > >> I've written a small assembler in Python 2.[67], and it needs to >> evaluate integer-valued arithmetic expressions in the context of a >> symbol table that defines integer values for a set of name

Re: Yet another attempt at a safe eval() call

2013-01-04 Thread Steven D'Aprano
On Fri, 04 Jan 2013 07:24:04 -0500, Terry Reedy wrote: > On 1/3/2013 6:25 PM, Grant Edwards wrote: >> >> I've written a small assembler in Python 2.[67], and it needs to >> evaluate integer-valued arithmetic expressions in the context of a >> symbol table that defines integer values for a set of n

Re: Yet another attempt at a safe eval() call

2013-01-04 Thread Terry Reedy
On 1/3/2013 6:25 PM, Grant Edwards wrote: I've written a small assembler in Python 2.[67], and it needs to evaluate integer-valued arithmetic expressions in the context of a symbol table that defines integer values for a set of names. The "right" thing is probably an expression parser/evaluator

Re: Yet another attempt at a safe eval() call

2013-01-03 Thread Chris Rebert
On Thu, Jan 3, 2013 at 3:25 PM, Grant Edwards wrote: > > I've written a small assembler in Python 2.[67], and it needs to > evaluate integer-valued arithmetic expressions in the context of a > symbol table that defines integer values for a set of names. The > "right" thing is probably an expressi

Re: Yet another attempt at a safe eval() call

2013-01-03 Thread Steven D'Aprano
On Thu, 03 Jan 2013 23:25:51 +, Grant Edwards wrote: > I've written a small assembler in Python 2.[67], and it needs to > evaluate integer-valued arithmetic expressions in the context of a > symbol table that defines integer values for a set of names. The > "right" thing is probably an expres

Re: Yet another attempt at a safe eval() call

2013-01-03 Thread Grant Edwards
On 2013-01-04, Tim Chase wrote: > On 01/03/13 17:25, Grant Edwards wrote: >> def lessDangerousEval(expr): >> global symbolTable >> if 'import' in expr: >> raise ParseError("operand expressions are not allowed to contain >> the string 'import'") >> globals = {'__builtins__'

Re: Yet another attempt at a safe eval() call

2013-01-03 Thread Tim Chase
On 01/03/13 17:25, Grant Edwards wrote: def lessDangerousEval(expr): global symbolTable if 'import' in expr: raise ParseError("operand expressions are not allowed to contain the string 'import'") globals = {'__builtins__': None} locals = symbolTable return eval

Yet another attempt at a safe eval() call

2013-01-03 Thread Grant Edwards
I've written a small assembler in Python 2.[67], and it needs to evaluate integer-valued arithmetic expressions in the context of a symbol table that defines integer values for a set of names. The "right" thing is probably an expression parser/evaluator using ast, but it looked like that would ta