Path: csiph.com!newsfeed.hal-mli.net!feeder3.hal-mli.net!newsfeed.hal-mli.net!feeder1.hal-mli.net!newsfeed.xs4all.nl!newsfeed2.news.xs4all.nl!xs4all!newsgate.cistron.nl!newsgate.news.xs4all.nl!post.news.xs4all.nl!not-for-mail
Newsgroups: comp.lang.python
Date: Sat, 5 Jan 2013 08:40:34 -0800 (PST)
In-Reply-To: <mailman.131.1357402645.2939.python-list@python.org>
Complaints-To: groups-abuse@google.com
Injection-Info: glegroupsg2000goo.googlegroups.com; posting-host=8.20.115.34; posting-account=9ZEQfQoAAABspi7JCv5jdcDZfN8CaWyj
References: <kc541v$3e4$1@reader1.panix.com> <50e6891c$0$30003$c3e8da3$5496439d@news.astraweb.com> <kc6tu3$s34$1@reader1.panix.com> <CAHVvXxRRRKh_0Pkb1wkkUfG+6ZqwFaH_5zBVwbSTd2qhse5HUA@mail.gmail.com> <CAPTjJmqtP5M-ZY13As7CMoT2fEHu8weJaGHQbqP3Rb+daX=ReA@mail.gmail.com> <mailman.131.1357402645.2939.python-list@python.org>
User-Agent: G2/1.0
MIME-Version: 1.0
Subject: Re: Yet another attempt at a safe eval() call
From: matt.newville@gmail.com
To: comp.lang.python@googlegroups.com
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Python List <python-list@python.org>
Precedence: list
Message-ID: <mailman.133.1357404044.2939.python-list@python.org>
Lines: 98
NNTP-Posting-Host: 2001:888:2000:d::a6
Xref: csiph.com comp.lang.python:36195

On Saturday, January 5, 2013 8:17:16 AM UTC-8, Oscar Benjamin wrote:
> On 5 January 2013 16:01, Chris Angelico <rosuav@gmail.com> wrote:
>=20
> > On Sun, Jan 6, 2013 at 2:56 AM, Oscar Benjamin
>=20
> > <oscar.j.benjamin@gmail.com> wrote:
>=20
> >> On 4 January 2013 15:53, Grant Edwards <invalid@invalid.invalid> wrote=
:
>=20
> >>> On 2013-01-04, Steven D'Aprano <steve+comp.lang.python@pearwood.info>=
 wrote:
>=20
> >>>> On Thu, 03 Jan 2013 23:25:51 +0000, Grant Edwards wrote:
>=20
> >>>>
>=20
> >>>> * But frankly, you should avoid eval, and write your own mini-intege=
r
>=20
> >>>>   arithmetic evaluator which avoids even the most remote possibility
>=20
> >>>>   of exploit.
>=20
> >>>
>=20
> >>> That's obviously the "right" thing to do.  I suppose I should figure
>=20
> >>> out how to use the ast module.
>=20
> >>
>=20
> >> Someone has already created a module that does this called numexpr. Is
>=20
> >> there some reason why you don't want to use that?
>=20
> >>
>=20
> >>>>> import numexpr
>=20
> >>>>> numexpr.evaluate('2+4*5')
>=20
> >> array(22, dtype=3Dint32)
>=20
> >>>>> numexpr.evaluate('2+a*5', {'a':4})
>=20
> >> array(22L)
>=20
> >
>=20
> > Is that from PyPI? It's not in my Python 3.3 installation. Obvious
>=20
> > reason not to use it: Unaware of it. :)
>=20
>=20
>=20
> My apologies. I should have at least provided a link:
>=20
> http://code.google.com/p/numexpr/
>=20
>=20
>=20
> I installed it from the ubuntu repo under the name python-numexpr. It
>=20
> is also on PyPI:
>=20
> http://pypi.python.org/pypi/numexpr
>=20
>=20
>=20
> numexpr is a well established project intended primarily for memory
>=20
> and cache efficient computations over large arrays of data. Possibly
>=20
> as a side effect, it can also be used to evaluate simple algebraic
>=20
> expressions involving ordinary scalar variables.
>=20
>=20
>=20
>=20
>=20
> Oscar

The asteval module http://pypi.python.org/pypi/asteval/0.9 and
http://newville.github.com/asteval/  might be another alternative.  It's no=
t as fast as numexpr, but a bit more general. It uses the ast module to "co=
mpile" an expression into the AST, then walks through that, intercepting Na=
me nodes and using a flat namespace of variables.  It disallows imports and=
 does not support all python constructs, but it is a fairly complete in sup=
porting python syntax.

It makes no claim at actually being safe from malicious attack, but should =
be safer than a straight eval(), and prevent accidental problems when evalu=
ating user-input as code.  If anyone can find exploits within it, I'd be ha=
ppy to try to fix them.

--Matt