Path: csiph.com!usenet.pasdenom.info!weretis.net!feeder4.news.weretis.net!ecngs!feeder2.ecngs.de!newsfeed.freenet.ag!news2.euro.net!newsgate.cistron.nl!newsgate.news.xs4all.nl!post.news.xs4all.nl!not-for-mail
Date: Thu, 14 Mar 2013 20:02:04 -0700
From: Ken Seehart <ken@seehart.com>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130307 Thunderbird/17.0.4
MIME-Version: 1.0
To: python-list@python.org
Subject: Re: Yet another attempt at a safe eval() call
References: <kc541v$3e4$1@reader1.panix.com> <mailman.78.1357302299.2939.python-list@python.org> <50e6da35$0$30003$c3e8da3$5496439d@news.astraweb.com>
In-Reply-To: <50e6da35$0$30003$c3e8da3$5496439d@news.astraweb.com>
Content-Type: multipart/alternative; boundary="------------080507040908010808010308"
Precedence: list
Reply-To: ken@seehart.com
Newsgroups: comp.lang.python
Message-ID: <mailman.3329.1363316529.2939.python-list@python.org>
Lines: 118
NNTP-Posting-Host: 2001:888:2000:d::a6
Xref: csiph.com comp.lang.python:41255

This is a multi-part message in MIME format.
--------------080507040908010808010308
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

On 1/4/2013 5:33 AM, Steven D'Aprano wrote:
> On Fri, 04 Jan 2013 07:24:04 -0500, Terry Reedy wrote:
>
>> On 1/3/2013 6:25 PM, Grant Edwards wrote:
>>> I've written a small assembler in Python 2.[67], and it needs to
>>> evaluate integer-valued arithmetic expressions in the context of a
>>> symbol table that defines integer values for a set of names.  The
>>> "right" thing is probably an expression parser/evaluator using ast, b=
ut
>>> it looked like that would take more code that the rest of the assembl=
er
>>> combined, and I've got other higher-priority tasks to get back to.
>> Will ast.literal_eval do what you want?
> No. Grant needs to support variables, not just literal constants, hence=
=20
> the symbol table.
>
>
Apologies for the delayed response...

Seems like it would be a bit safer and easier to approach this problem
by stretching the capability of ast.literal_eval() rather than
attempting to sandbox eval().

How about ast.literal_eval after performing lexical substitution using
the symbol table?

Assignment into the symbol table, and error handling, are exercises left
to the reader.

Something vaguely like this:

    /pseudocode:/

    def safe_eval(s, symbols=3D{}):
        while search(s, r'\w+'):
            replace match with '('+repr(symbols[match])+')' in s
        return ast.literal_eval(s)

- Ken


--------------080507040908010808010308
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit

<html>
  <head>
    <meta content="text/html; charset=ISO-8859-1"
      http-equiv="Content-Type">
  </head>
  <body text="#000000" bgcolor="#FFFFFF">
    <div class="moz-cite-prefix">On 1/4/2013 5:33 AM, Steven D'Aprano
      wrote:<br>
    </div>
    <blockquote
      cite="mid:50e6da35$0$30003$c3e8da3$5496439d@news.astraweb.com"
      type="cite">
      <pre wrap="">On Fri, 04 Jan 2013 07:24:04 -0500, Terry Reedy wrote:

</pre>
      <blockquote type="cite">
        <pre wrap="">On 1/3/2013 6:25 PM, Grant Edwards wrote:
</pre>
        <blockquote type="cite">
          <pre wrap="">
I've written a small assembler in Python 2.[67], and it needs to
evaluate integer-valued arithmetic expressions in the context of a
symbol table that defines integer values for a set of names.  The
"right" thing is probably an expression parser/evaluator using ast, but
it looked like that would take more code that the rest of the assembler
combined, and I've got other higher-priority tasks to get back to.
</pre>
        </blockquote>
        <pre wrap="">
Will ast.literal_eval do what you want?
</pre>
      </blockquote>
      <pre wrap="">
No. Grant needs to support variables, not just literal constants, hence 
the symbol table.


</pre>
    </blockquote>
    Apologies for the delayed response...<br>
    <br>
    Seems like it would be a bit safer and easier to approach this
    problem by stretching the capability of ast.literal_eval() rather
    than attempting to sandbox eval().<br>
    <br>
    How about ast.literal_eval after performing lexical substitution
    using the symbol table?<br>
    <br>
    Assignment into the symbol table, and error handling, are exercises
    left to the reader. <br>
    <br>
    Something vaguely like this:<br>
    <blockquote><i>pseudocode:</i><br>
      <br>
      <tt>def safe_eval(s, symbols={}):</tt><br>
      <tt>&nbsp;&nbsp;&nbsp; while search(s, r'\w+')</tt><tt>:</tt><br>
      <tt>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; replace match with '('+repr(symbols[match])</tt><tt>+')'
        in s</tt><br>
      <tt>&nbsp;&nbsp;&nbsp; return ast.literal_eval(s)</tt><br>
      <br>
    </blockquote>
    - Ken<br>
    <br>
  </body>
</html>

--------------080507040908010808010308--