Untrusted code execution

Ian Kelly ian.g.kelly at gmail.com
Tue Apr 5 13:52:52 EDT 2016


On Tue, Apr 5, 2016 at 11:48 AM, Chris Angelico <rosuav at gmail.com> wrote:
> Your code is a *lot* safer for using 'eval' rather than 'exec'.
> Otherwise, you'd be easily exploited using exceptions, which carry a
> ton of info. But even so, I would not bet money (much less the
> security of my systems) on this being safe.

Not to mention "import". :-P



More information about the Python-list mailing list