11 ms·
Static analysis of Python code should include review of "unsafe" things like exec(), eval(), ctypes, c strings, memcpy (*),. Containers are considered nearly s
by westurner 3y ago
Static analysis of Python code should include review of "unsafe" things like exec(), eval(), ctypes, c strings, memcpy (*),.
Containers are considered nearly sufficient to sandbox Python, which cannot be effectively sandboxed using Python itself. Isn't that actually true for all languages though?
There's a RustPython, but it does support CFFI and __builtins__.eval, so
- maple3142 3y agoThe example given by parent does not need eval to trigger though. Just create a function and replace its code object then call it, it will easily segfault.