Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.python > #75503

Re: dict to boolean expression, how to?

Show all headers | View raw

On 8/1/2014 11:02 AM, Steven D'Aprano wrote:
> On Fri, 01 Aug 2014 09:32:36 -0400, Roy Smith wrote:
>
>> In article <53db95e6$0$29986$c3e8da3$5496439d@news.astraweb.com>,
>>   Steven D'Aprano <steve+comp.lang.python@pearwood.info> wrote:
>>
>>> eval is almost never the right solution to any problem, and in the very
>>> few exceptions, it needs careful handling by an expert to ensure you're
>>> not introducing serious security bugs.
>>
>> Corollary to that rule: All the people who are smart enough to actually
>> understand how to use eval() safety, are also smart enough to know not
>> to use it.

Eval is a specialized version of exec. Everything you do on a computer 
is evaluating and executing code. Here is a highly simplified version of 
a Python interpreter:

user_program = get_user_python_code()
__main__ = make_global_namespace()
exec(user_program, __main__, __main__)

CPython codes an expansion of the above in C. Idle uses an expansion of 
the above to do the same thing.

The threat model is executing code from someone who does not have 
physical access to a machine to just run code and who should not be trusted.

> ... smart enough to know WHEN to use it (which is *rarely*).
>
> That's in production code, of course. There's nothing wrong with using
> eval in the interactive interpreter for quick and dirty exploration. But
> even then, I find that it's usually easier to write a line or two of
> Python code to process something than to try using eval.
>
> There are uses for eval (or exec), even if production code. See
> collections.namedtuple, doctest, and timeit, for example. In the first
> place, namedtuple takes extra care to sanitise the data being used. In
> the case of doctest and timeit, the whole point of them is to run trusted
> code. If you can't trust your own code that you're timing, what can you
> trust?

Exactly. If someone can start Python or Idle on a machine, they can 
start Windows Explorer and Command Prompt. Idle exec's user code because 
emulating the interactive interpreter is part of its purpose. It 
sometimes evals expression within user code in response to user requests.

-- 
Terry Jan Reedy

Back to comp.lang.python | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

dict to boolean expression, how to? Alex van der Spek <zdoor@xs4all.nl> - 2014-08-01 12:45 +0000
  Re: dict to boolean expression, how to? Chris Angelico <rosuav@gmail.com> - 2014-08-01 23:04 +1000
  Re: dict to boolean expression, how to? Roy Smith <roy@panix.com> - 2014-08-01 09:24 -0400
  Re: dict to boolean expression, how to? Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2014-08-01 13:28 +0000
    Re: dict to boolean expression, how to? Roy Smith <roy@panix.com> - 2014-08-01 09:32 -0400
      Re: dict to boolean expression, how to? Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2014-08-01 15:02 +0000
        Re: dict to boolean expression, how to? Terry Reedy <tjreedy@udel.edu> - 2014-08-01 18:16 -0400
    Re: dict to boolean expression, how to? Mark Lawrence <breamoreboy@yahoo.co.uk> - 2014-08-01 16:50 +0100
      Re: dict to boolean expression, how to? Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2014-08-01 16:35 +0000
  Re: dict to boolean expression, how to? Alex van der Spek <zdoor@xs4all.nl> - 2014-08-01 14:26 +0000
    Re: dict to boolean expression, how to? marco.nawijn@colosso.nl - 2014-08-01 08:07 -0700
    Re: dict to boolean expression, how to? Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2014-08-01 15:24 +0000
      Re: dict to boolean expression, how to? Mark Lawrence <breamoreboy@yahoo.co.uk> - 2014-08-01 17:03 +0100
    Re: dict to boolean expression, how to? Peter Otten <__peter__@web.de> - 2014-08-01 17:44 +0200
      eval [was Re: dict to boolean expression, how to?] Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2014-08-02 02:59 +0000
        Re: eval [was Re: dict to boolean expression, how to?] Peter Otten <__peter__@web.de> - 2014-08-02 09:43 +0200
        Re: eval [was Re: dict to boolean expression, how to?] Mark Lawrence <breamoreboy@yahoo.co.uk> - 2014-08-02 08:59 +0100
        Re: eval [was Re: dict to boolean expression, how to?] Duncan Booth <duncan.booth@invalid.invalid> - 2014-08-05 11:57 +0000
          Re: eval [was Re: dict to boolean expression, how to?] Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2014-08-06 02:25 +1000
    Re: dict to boolean expression, how to? Mark Lawrence <breamoreboy@yahoo.co.uk> - 2014-08-01 17:12 +0100
    Re: dict to boolean expression, how to? Peter Pearson <ppearson@nowhere.invalid> - 2014-08-01 17:00 +0000
  Re: dict to boolean expression, how to? Ned Batchelder <ned@nedbatchelder.com> - 2014-08-01 10:29 -0400

csiph-web