3 ms·
I wonder how many Python packages have a justifiable reason for using `eval()` to begin with. I've been writing Python professionally for almost a decade and I'
by CivBase 5y ago
I wonder how many Python packages have a justifiable reason for using `eval()` to begin with. I've been writing Python professionally for almost a decade and I've never run into a use case where it has been necessary. It's occasionally useful for debugging, but that's all I've ever legitimately considered it for.
It's neat that JFrog can detect evaluation of encoded strings, but I think I'd prefer to just set a static analysis rule which prevents devs from using `eval()` in the first place.
- psanford 5y agoThere are plenty of ways you can obfuscate calls to `eval`. `unpickle` is a classic example.
- banana_giraffe 5y agoYou can always call eval without ever mentioning eval in code: __builtins__.__dict__[''.join(chr(x^y^(i+33)) for i,(x,y) in enumerate(zip(*[iter(ord(z) for z in '2vb63qz2')]*2)))]("print('hello, world')") Maybe there are ways to detect all of the paths, but it feels like a tricky quest down lots of rabbit holes to me. There are also some fairly big packages that use eval(), like flask, matplotlib, numba, pandas, and plenty of others. Perhaps they could be modified to not use eval, but it might be more common than you expect.
- hiccuphippo 5y agoI don't think there's a good reason to have eval in interpreted languages. Sure the REPL uses it but it could be implemented internal to the REPL instead of exposing it in the language.
- blibble 5y agonamedtuple used exec() (I've also used exec() for some nasty bundling of multiple python files into one before)