Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Warn that overriding__builtins__ foreval is not a security mechanism#145773

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Open
StanFromIreland wants to merge4 commits intopython:main
base:main
Choose a base branch
Loading
fromStanFromIreland:eval_sec
Open
Changes fromall commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 11 additions & 9 deletionsDoc/library/functions.rst
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -606,17 +606,18 @@ are always available. They are listed here in alphabetical order.
..warning::

This function executes arbitrary code. Calling it with
user-supplied inputmay lead to security vulnerabilities.
untrusteduser-supplied inputwill lead to security vulnerabilities.

The *source* argument is parsed and evaluated as a Python expression
(technically speaking, a condition list) using the *globals* and *locals*
mappings as global and local namespace. If the *globals* dictionary is
present and does not contain a value for the key ``__builtins__``, a
reference to the dictionary of the built-in module:mod:`builtins` is
inserted under that key before *source* is parsed. That way you can
control what builtins are available to the executed code by inserting your
own ``__builtins__`` dictionary into *globals* before passing it to
:func:`eval`. If the *locals* mapping is omitted it defaults to the
inserted under that key before *source* is parsed.
Overriding ``__builtins__`` can be used to restrict or change the available
names, but this is **not** a security mechanism: the executed code can
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Either decide to keep the "this" or drop it, but make it similar to exec().

Copy link
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

I have no idea what happened. The suggestions I applied had "this" in both, GH must have some outtage.

This comment was marked as resolved.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

NVM, we use "executed" afterwards. It's only used in the preamble of the function.

still access all builtins.
If the *locals* mapping is omitted it defaults to the
*globals* dictionary. If both mappings are omitted, the source is
executed with the *globals* and *locals* in the environment where
:func:`eval` is called. Note, *eval()* will only have access to the
Expand DownExpand Up@@ -671,7 +672,7 @@ are always available. They are listed here in alphabetical order.
..warning::

This function executes arbitrary code. Calling it with
user-supplied inputmay lead to security vulnerabilities.
untrusteduser-supplied inputwill lead to security vulnerabilities.

This function supports dynamic execution of Python code. *source* must be
either a string or a code object. If it is a string, the string is parsed as
Expand DownExpand Up@@ -702,9 +703,10 @@ are always available. They are listed here in alphabetical order.

If the *globals* dictionary does not contain a value for the key
``__builtins__``, a reference to the dictionary of the built-in module
:mod:`builtins` is inserted under that key. That way you can control what
builtins are available to the executed code by inserting your own
``__builtins__`` dictionary into *globals* before passing it to:func:`exec`.
:mod:`builtins` is inserted under that key.
Overriding ``__builtins__`` can be used to restrict or change the available
names, but is **not** a security mechanism: the executed code can
still access all builtins.

The *closure* argument specifies a closure--a tuple of cellvars.
It's only valid when the *object* is a code object containing
Expand Down
Loading

[8]ページ先頭

©2009-2026 Movatter.jp