Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!news.mixmin.net!rt.uk.eu.org!newsfeed.xs4all.nl!newsfeed4.news.xs4all.nl!xs4all!newsgate.cistron.nl!newsgate.news.xs4all.nl!post.news.xs4all.nl!not-for-mail
To: python-list@python.org
From: Terry Reedy <tjreedy@udel.edu>
Subject: Re: dict to boolean expression, how to?
Date: Fri, 01 Aug 2014 18:16:54 -0400
References: <53db8bd8$0$2976$e4fe514c@news2.news.xs4all.nl> <53db95e6$0$29986$c3e8da3$5496439d@news.astraweb.com> <roy-6C65E6.09323601082014@news.panix.com> <53dbabee$0$29986$c3e8da3$5496439d@news.astraweb.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.6.0
In-Reply-To: <53dbabee$0$29986$c3e8da3$5496439d@news.astraweb.com>
Precedence: list
Newsgroups: comp.lang.python
Message-ID: <mailman.12526.1406931438.18130.python-list@python.org>
Lines: 50
NNTP-Posting-Host: 2001:888:2000:d::a6
Xref: csiph.com comp.lang.python:75503

On 8/1/2014 11:02 AM, Steven D'Aprano wrote:
> On Fri, 01 Aug 2014 09:32:36 -0400, Roy Smith wrote:
>
>> In article <53db95e6$0$29986$c3e8da3$5496439d@news.astraweb.com>,
>>   Steven D'Aprano <steve+comp.lang.python@pearwood.info> wrote:
>>
>>> eval is almost never the right solution to any problem, and in the very
>>> few exceptions, it needs careful handling by an expert to ensure you're
>>> not introducing serious security bugs.
>>
>> Corollary to that rule: All the people who are smart enough to actually
>> understand how to use eval() safety, are also smart enough to know not
>> to use it.

Eval is a specialized version of exec. Everything you do on a computer 
is evaluating and executing code. Here is a highly simplified version of 
a Python interpreter:

user_program = get_user_python_code()
__main__ = make_global_namespace()
exec(user_program, __main__, __main__)

CPython codes an expansion of the above in C. Idle uses an expansion of 
the above to do the same thing.

The threat model is executing code from someone who does not have 
physical access to a machine to just run code and who should not be trusted.

> ... smart enough to know WHEN to use it (which is *rarely*).
>
> That's in production code, of course. There's nothing wrong with using
> eval in the interactive interpreter for quick and dirty exploration. But
> even then, I find that it's usually easier to write a line or two of
> Python code to process something than to try using eval.
>
> There are uses for eval (or exec), even if production code. See
> collections.namedtuple, doctest, and timeit, for example. In the first
> place, namedtuple takes extra care to sanitise the data being used. In
> the case of doctest and timeit, the whole point of them is to run trusted
> code. If you can't trust your own code that you're timing, what can you
> trust?

Exactly. If someone can start Python or Idle on a machine, they can 
start Windows Explorer and Command Prompt. Idle exec's user code because 
emulating the interactive interpreter is part of its purpose. It 
sometimes evals expression within user code in response to user requests.

-- 
Terry Jan Reedy