ansaurus

Question

Python convert formatted string to list.

Answer 1

+1 A:

eval("[u'foo']", {'__builtins__':[]}, {})

leoluk 2010-09-01 22:46:20

You know that passing empty dicts for `locals` and `globals` isn't enough to 'secure' `eval`, yes? This still gives an attacker basically full access to your system.

Aaron Gallagher 2010-09-01 23:39:43

POC: `eval('__import__("os").getcwd()', {}, {})`, I edited my answer

leoluk 2010-09-01 23:42:09

@leoluk, that doesn't 'prove' anything. `eval("[x for x in type(type(1)).__bases__[0].__subclasses__() if x.__name__ == 'file'][0]('/etc/passwd').readline()", {}, {})` gives me the first line of `/etc/passwd` on my system.

Aaron Gallagher 2010-09-01 23:49:19

@Aaron, cool... By the way, if I can't use literal_eval(), what would you suggest as a 'secure' eval?

Albert 2010-09-02 00:18:25

@Albert, I would suggest modifying your desires so that you don't have to.

Aaron Gallagher 2010-09-02 00:30:43

@Aaron: `eval('__import__("os").getcwd()', {}, {})` is no proof, it works fine. I just wanted to give an example that the first revision was insecure, and I fixed it.

leoluk 2010-09-02 15:29:27

Answer 2

+8 A:

>>> import ast
>>> s = "[u'foo']"
>>> ast.literal_eval(s)
[u'foo']

documentation

Adam Bernier 2010-09-01 22:47:40

+1 for the safe `literal_eval` instead of `eval`.

Greg Hewgill 2010-09-01 22:54:57

ansaurus

tags:

views:

answers:

Python convert formatted string to list.

related questions