Python: make eval safe

user_63051 0
Viewed 42973

I want an easy way to do a "calculator API" in Python.

Right now I don't care much about the exact set of features the calculator is going to support.

I want it to receive a string, say "1+1" and return a string with the result, in our case "2".

Is there a way to make eval safe for such a thing?

For a start I would do 

env = {}
env["locals"]   = None
env["globals"]  = None
env["__name__"] = None
env["__file__"] = None
env["__builtins__"] = None

eval(users_str, env)

so that the caller cannot mess with my local variables (or see them).

But I am sure I am overseeing a lot here.

Are eval's security issues fixable or are there just too many tiny details to get it working right?

eval python
4 Answers

Perl has a Safe eval module http://perldoc.perl.org/Safe.html

Googling "Python equivalent of Perl Safe" finds http://docs.python.org/2/library/rexec.html

but this Python "restricted exec" is deprecated.

--

overall, "eval" security, in any language, is a big issue. SQL injection attacks are just an example of such a security hole. Perl Safe has had security bugs over the years - most recent one I remember, it was safe, except for destructors on objects returned from the safe eval.

It's the sort of thing that i might use for my own tools, but not web exposed.

However, I hope that someday fully secure evals will be available in many / any languages.

user_10511150
Related