Eval - Security Risks

Security Risks

Special care must be taken when using eval with data from an untrusted source. For instance, assuming that the get_data function gets data from the Internet, this Python code is insecure:

session = False data = get_data foo = eval(data)

An attacker could supply the program with the string "session.update(authenticated=True)" as data, which would update the session dictionary to set an authenticated key to be True. To remedy this, all data which will be used with eval must be escaped, or it must be run without access to potentially harmful functions.

Read more about this topic:  Eval

Famous quotes containing the words security and/or risks:

    “If we could have any security against moods! If the profoundest prophet could be holden to his words, and the hearer who is ready to sell all and join the crusade, could have any certificate that to-morrow his prophet shall not unsay his testimony!”
    —Ralph Waldo Emerson (1803–1882)

    “In America any boy may become President, and I suppose it’s just one of the risks he takes!”
    —Adlai Stevenson (1900–1965)