5 ms·
This made me giggle. And after the exec, if they asked me to parse a Python expression, I'd type "eval(expr)".
by fuzztester 2y ago
This made me giggle.
And after the exec, if they asked me to parse a Python expression, I'd type "eval(expr)".
- fuzztester 2y agoOr even: import code code.interact() # https://docs.python.org/3/library/code.html https://docs.python.org/3/library/code.html
- chii 2y agoIt's funny, because at university, you would be assessed (perhaps) on such a question, and you would not be allowed to use these things! And yet, in "real life", this is exactly how you'd go about accomplishing the task.
- kstrauser 2y agoHeh! But for real, though. Then you have a repl with access to all the functions in the os module. You can glob files to iterate over /proc. You can send signals. You can open network connections. As far as emergency shells go, you could do far, far worse. Edit: also, all valid JSON is valid Python. Do not `eval(input_data)` in prod or I will haunt you. But, in an emergency…
- fuzztester 2y agoOh, I know about the security issues with eval. My example was just as a joke. For real use, I would only use it with my own trusted input.
- tetha 2y agoI mean realistically speaking: If I can do `foo = <paste>`, check `typeof(foo)`. and output foo again to double-check what the REPL thinks foo contains, then I'm pretty safe to `eval(foo)`. Sure, you could fake it with custom objects and all of that, but not when I'm pasting a string value into a REPL. If you had hijacked my workstation, shell or the remote python to the point you can exploit that... Yeah. I don't think you'd need me as a user then anymore.