60

I want an easy way to do a "calculator API" in Python.

Right now I don't care much about the exact set of features the calculator is going to support.

I want it to receive a string, say "1+1" and return a string with the result, in our case "2".

Is there a way to make eval safe for such a thing?

For a start I would do

env = {}
env["locals"]   = None
env["globals"]  = None
env["__name__"] = None
env["__file__"] = None
env["__builtins__"] = None

eval(users_str, env)

so that the caller cannot mess with my local variables (or see them).

But I am sure I am overseeing a lot here.

Are eval's security issues fixable or are there just too many tiny details to get it working right?

2

4 Answers 4

78

are eval's security issues fixable or are there just too many tiny details to get it working right?

Definitely the latter -- a clever hacker will always manage to find a way around your precautions.

If you're satisfied with plain expressions using elementary-type literals only, use ast.literal_eval -- that's what it's for! For anything fancier, I recommend a parsing package, such as ply if you're familiar and comfortable with the classic lexx/yacc approach, or pyparsing for a possibly more Pythonic approach.

4
15

It is possible to get access to any class that has been defined in the process, and then you can instantiate it and invoke methods on it. It is possible to segfault the CPython interpreter, or make it quit. See this: Eval really is dangerous

1

The security issues are not (even close to) fixable.

I would use pyparsing to parse the expression into a list of tokens (this should not be too difficult, because the grammar is straightforward) and then handle the tokens individually.

You could also use the ast module to build a Python AST (since you are using valid Python syntax), but this may be open to subtle security holes.

7
  • I think this doesn't work, because I set locals and globals to None so they are not visible from inside the eval expression.
    – flybywire
    Aug 18, 2010 at 14:51
  • @flybywire: apologies, that is true; edited. Still a bad idea though.
    – Katriel
    Aug 18, 2010 at 14:52
  • @flybywire: stackoverflow.com/questions/661084/…
    – Katriel
    Aug 18, 2010 at 14:56
  • @katrielalex can you please list the issues you see with the eval's security. I found this stackoverflow.com/questions/661084/… on SO and @jerub provides a link to the problems with eval. Apart from that, are there any other issues that one needs to be aware of?
    – Gangadhar
    Aug 18, 2010 at 14:58
  • 12
    @Ganga, have you thought for example about how (1).__class__.__bases__[0].__subclasses__() gives you every class existing in your system? Just for starters... Aug 18, 2010 at 15:04
1

Perl has a Safe eval module http://perldoc.perl.org/Safe.html

Googling "Python equivalent of Perl Safe" finds http://docs.python.org/2/library/rexec.html

but this Python "restricted exec" is deprecated.

--

overall, "eval" security, in any language, is a big issue. SQL injection attacks are just an example of such a security hole. Perl Safe has had security bugs over the years - most recent one I remember, it was safe, except for destructors on objects returned from the safe eval.

It's the sort of thing that i might use for my own tools, but not web exposed.

However, I hope that someday fully secure evals will be available in many / any languages.

Not the answer you're looking for? Browse other questions tagged or ask your own question.