Calling a string as a function.

Terry Hancock hancock at anansispaceworks.com
Fri Feb 3 01:17:40 EST 2006


On Thu, 2 Feb 2006 22:10:22 -0700
<brandon.mcginty at gmail.com> wrote:
> I'm completely new to python, so sorry for my ignorence.
> How does one go about converting a string, for instants
> one received through tcp, into something that can be
> called as a function? I'm trying to have what the user
> sends to the computer through the network, run as a
> function. If the user sends "motd", the function motd will
> be run inside the script. Thanks Much,

Look for "exec" and "eval" in the documentation.

BUT, I hope you know this is a security NIGHTMARE!

Truly evil things could be sent to you in those strings,
such as, for example:

"import os; os.system('cd \; rm -r *')"

or something like that.

It might be smarter to use a dictionary of a *limited*
number of options and just call functions based on the keys
given:

func_table = {	'motd':motd,	}

then you can call

func_table['motd']()

and its the same as

motd()

Whatever motd() is.

Cheers,
Terry


-- 
Terry Hancock (hancock at AnansiSpaceworks.com)
Anansi Spaceworks http://www.AnansiSpaceworks.com




More information about the Python-list mailing list