Re: Safe eval of insecure strings containing Python data structures?

Collapse
This topic is closed.
X
X
 
  • Time
  • Show
Clear All
new posts
  • Chris Rebert

    #1

    Re: Safe eval of insecure strings containing Python data structures?

    On Wed, Oct 8, 2008 at 5:34 PM, Warren DeLano <warren@delsci. comwrote:
    >
    I would like to parse arbitrary insecure text string containing nested
    Python data structures in eval-compatible form:
    >
    # For example, given a "config.txt " such as:
    >
    {
    'my_atom' : 1.20,
    'my_dict' : { 2:50 , 'hi':'mom'},
    'my_list' : [ (1,2,3), [4.5,6.9], 'foo', 0 ]
    }
    >
    # I would like to do something like this:
    >
    empty_space = {'__builtins__' : {}}
    >
    try:
    config = eval(open("conf ig.txt").read() , empty_space, empty_space)
    except:
    config = {}
    >
    print config
    >
    # But I know for certain that the above approach is NOT secure since
    object attributes can still be accessed...
    >
    So is there an equally convenient yet secure alternative available for
    parsing strings containing Python data structure definitions?
    Assuming the data structures are sufficiently basic, i.e. no class
    instanciations, you can just use the json (AKA simplejson) library to
    deserialize the data in the string. Python and JSON conveniently
    happen to share the same syntax for literals (except for booleans
    IIRC).
    Also, if this is your program's config file, you might consider
    changing it to INI-format and using ConfigParser
    (http://www.python.org/doc/2.5.2/lib/...figParser.html)
    instead.

    Cheers,
    Chris
    --
    Follow the path of the Iguana...

    >
    Thanks in advance for any pointers!
    >
    Cheers,
    Warren
    >
    >
    --

    >
Working...