Is there a way to secure strings for Python's eval?

后端 未结 7 2058
悲哀的现实
悲哀的现实 2021-02-08 07:43

There are many questions on SO about using Python\'s eval on insecure strings (eg.: Security of Python\'s eval() on untrusted strings?, Python: make eval safe).

7条回答
  •  误落风尘
    2021-02-08 08:07

    To study how to make safe eval I suggest RestrictedPython module (over 10 years of production usage, one fine piece of Python software)

    http://pypi.python.org/pypi/RestrictedPython

    RestrictedPython takes Python source code and modifies its AST (Abstract Syntax Tree) to make the evaluation safe within the sandbox, without leaking any Python internals which might allow to escape the sandbox.

    From RestrictedPython source code you'll learn what kind of tricks are needed to perform to make Python sandboxed safe.

提交回复
热议问题