Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.python > #16908
| From | Peter Otten <__peter__@web.de> |
|---|---|
| Subject | Re: Dynamic variable creation from string |
| Date | 2011-12-09 12:27 +0100 |
| Organization | None |
| References | <b078a04b-024b-48dc-b24a-8f4ce75fa238@13g2000vbu.googlegroups.com> <4edffed8$0$29988$c3e8da3$5496439d@news.astraweb.com> <mailman.3388.1323304088.27778.python-list@python.org> <qotobvjv3xj.fsf@ruuvi.it.helsinki.fi> <8ebfe32c-46a5-4bdc-a853-018d7f72d3d3@y18g2000yqy.googlegroups.com> |
| Newsgroups | comp.lang.python |
| Message-ID | <mailman.3468.1323430072.27778.python-list@python.org> (permalink) |
Massi wrote:
> for k in D : exec "%s = D[k]" %k
>
> That seems to do the trick, but someone speaks about "dirty code", can
> anyone point me out which problems this can generate?
exec can run arbitrary code, so everybody reading the above has to go back
to the definition of D to verify that it can only contain "safe" keys.
Filling D with user-input is right out because a malicious user could do
anything he likes. Here's a harmless demo that creates a file:
>>> d = {"x = 42\nwith open('tmp.txt', 'w') as f:\n f.write('whatever')\nx":
123}
>>> for k in d: exec "%s = d[k]" % k
...
>>> x
123
>>> open("tmp.txt").read()
'whatever'
Back to comp.lang.python | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Dynamic variable creation from string Massi <massi_srb@msn.com> - 2011-12-07 09:09 -0800
Re: Dynamic variable creation from string John Gordon <gordon@panix.com> - 2011-12-07 17:45 +0000
Re: Dynamic variable creation from string MRAB <python@mrabarnett.plus.com> - 2011-12-07 18:07 +0000
Re: Dynamic variable creation from string "Waldek M." <wm@localhost.localdomain> - 2011-12-07 18:46 +0100
Re: Dynamic variable creation from string Chris Angelico <rosuav@gmail.com> - 2011-12-08 04:52 +1100
Re: Dynamic variable creation from string Terry Reedy <tjreedy@udel.edu> - 2011-12-07 17:59 -0500
Re: Dynamic variable creation from string Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2011-12-08 00:03 +0000
Re: Dynamic variable creation from string Terry Reedy <tjreedy@udel.edu> - 2011-12-07 19:27 -0500
Re: Dynamic variable creation from string Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2011-12-08 01:59 +0000
Re: Dynamic variable creation from string Jussi Piitulainen <jpiitula@ling.helsinki.fi> - 2011-12-08 10:54 +0200
Re: Dynamic variable creation from string Massi <massi_srb@msn.com> - 2011-12-09 01:55 -0800
Re: Dynamic variable creation from string Peter Otten <__peter__@web.de> - 2011-12-09 12:27 +0100
Re: Dynamic variable creation from string Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2011-12-09 11:59 +0000
Re: Dynamic variable creation from string Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2011-12-09 12:03 +0000
Re: Dynamic variable creation from string Chris Angelico <rosuav@gmail.com> - 2011-12-09 23:08 +1100
Re: Dynamic variable creation from string Ethan Furman <ethan@stoneleaf.us> - 2011-12-09 12:01 -0800
Re: Dynamic variable creation from string Nobody <nobody@nowhere.com> - 2011-12-11 06:42 +0000
Re: Dynamic variable creation from string alex23 <wuwei23@gmail.com> - 2011-12-11 19:31 -0800
Re: Dynamic variable creation from string Ethan Furman <ethan@stoneleaf.us> - 2011-12-11 21:00 -0800
Re: Dynamic variable creation from string alex23 <wuwei23@gmail.com> - 2011-12-11 22:50 -0800
Re: Dynamic variable creation from string Chris Angelico <rosuav@gmail.com> - 2011-12-08 14:13 +1100
Re: Dynamic variable creation from string alex23 <wuwei23@gmail.com> - 2011-12-11 23:11 -0800
Re: Dynamic variable creation from string 88888 Dihedral <dihedral88888@googlemail.com> - 2011-12-12 04:43 -0800
Re: Dynamic variable creation from string 88888 Dihedral <dihedral88888@googlemail.com> - 2011-12-12 04:49 -0800
Re: Dynamic variable creation from string alex23 <wuwei23@gmail.com> - 2011-12-12 15:45 -0800
Re: Dynamic variable creation from string Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2011-12-13 01:35 +0000
Re: Dynamic variable creation from string 88888 Dihedral <dihedral88888@googlemail.com> - 2011-12-13 06:21 -0800
csiph-web