Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork34.2k
Warn that overriding__builtins__ foreval is not a security mechanism#145773
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
base:main
Are you sure you want to change the base?
Changes fromall commits
49f8d6a6baacfbd486584f69e67cFile filter
Filter by extension
Conversations
Uh oh!
There was an error while loading.Please reload this page.
Jump to
Uh oh!
There was an error while loading.Please reload this page.
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -606,17 +606,18 @@ are always available. They are listed here in alphabetical order. | ||
| ..warning:: | ||
| This function executes arbitrary code. Calling it with | ||
| untrusteduser-supplied inputwill lead to security vulnerabilities. | ||
| The *source* argument is parsed and evaluated as a Python expression | ||
| (technically speaking, a condition list) using the *globals* and *locals* | ||
| mappings as global and local namespace. If the *globals* dictionary is | ||
| present and does not contain a value for the key ``__builtins__``, a | ||
| reference to the dictionary of the built-in module:mod:`builtins` is | ||
| inserted under that key before *source* is parsed. | ||
| Overriding ``__builtins__`` can be used to restrict or change the available | ||
| names, but this is **not** a security mechanism: the executed code can | ||
Member There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others.Learn more. Either decide to keep the "this" or drop it, but make it similar to exec(). MemberAuthor There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others.Learn more. I have no idea what happened. The suggestions I applied had "this" in both, GH must have some outtage.
This comment was marked as resolved.Sorry, something went wrong. Uh oh!There was an error while loading.Please reload this page. Member There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others.Learn more. NVM, we use "executed" afterwards. It's only used in the preamble of the function. | ||
| still access all builtins. | ||
| If the *locals* mapping is omitted it defaults to the | ||
| *globals* dictionary. If both mappings are omitted, the source is | ||
| executed with the *globals* and *locals* in the environment where | ||
| :func:`eval` is called. Note, *eval()* will only have access to the | ||
| @@ -671,7 +672,7 @@ are always available. They are listed here in alphabetical order. | ||
| ..warning:: | ||
| This function executes arbitrary code. Calling it with | ||
| untrusteduser-supplied inputwill lead to security vulnerabilities. | ||
| This function supports dynamic execution of Python code. *source* must be | ||
| either a string or a code object. If it is a string, the string is parsed as | ||
| @@ -702,9 +703,10 @@ are always available. They are listed here in alphabetical order. | ||
| If the *globals* dictionary does not contain a value for the key | ||
| ``__builtins__``, a reference to the dictionary of the built-in module | ||
| :mod:`builtins` is inserted under that key. | ||
| Overriding ``__builtins__`` can be used to restrict or change the available | ||
| names, but is **not** a security mechanism: the executed code can | ||
| still access all builtins. | ||
| The *closure* argument specifies a closure--a tuple of cellvars. | ||
| It's only valid when the *object* is a code object containing | ||
Uh oh!
There was an error while loading.Please reload this page.