RE: RE: Advise of programming one of my first programs

From	"Prasad, Ramit" <ramit.prasad@jpmorgan.com>
Subject	RE: RE: Advise of programming one of my first programs
Date	2012-03-28 14:57 +0000
References	(1 earlier) <5B80DD153D7D744689F57F4FB69AF4740928C365@SCACMX008.exchad.jpmchase.net> <CAKhY55O9zE_jxF5PvzOF0DGifRT2gZLbRHiuQ_a1vA-aGGDb9g@mail.gmail.com> <5B80DD153D7D744689F57F4FB69AF4740928E137@SCACMX008.exchad.jpmchase.net> <4F72385E.8020804@cs.wisc.edu> <CABicbJKMdxbQ-r2Qmxy2n8W2YpxNAXos9WLKuz7rrhLz8KF+ow@mail.gmail.com>
Newsgroups	comp.lang.python
Message-ID	<mailman.1077.1332946697.3037.python-list@python.org> (permalink)

Show all headers | View raw

> >> The use of eval is dangerous if you are not *completely* sure what is
> >> being passed in. Try using pickle instead:
> >> http://docs.python.org/release/2.5.2/lib/pickle-example.html
> >
> >
> > Um, at least by my understanding, the use of Pickle is also dangerous if
> you
> > are not completely sure what is being passed in:
> 
> Oh goodness yes. pickle is exactly as unsafe as eval is. Try running this
> code:
> 
> from pickle import loads
> loads("c__builtin__\neval\n(c__builtin__\nraw_input\n(S'py>'\ntRtR.")

It might be as dangerous, but which is more likely to cause problems in
real world scenarios?

Ramit


Ramit Prasad | JPMorgan Chase Investment Bank | Currencies Technology
712 Main Street | Houston, TX 77002
work phone: 713 - 216 - 5423

--


This email is confidential and subject to important disclaimers and
conditions including on offers for the purchase or sale of
securities, accuracy and completeness of information, viruses,
confidentiality, legal privilege, and legal entity disclaimers,
available at http://www.jpmorgan.com/pages/disclosures/email.

Back to comp.lang.python | Previous | Next | Find similar | Unroll thread

Thread

RE: RE: Advise of programming one of my first programs "Prasad, Ramit" <ramit.prasad@jpmorgan.com> - 2012-03-28 14:57 +0000

csiph-web