3 ms·
Is evaling raw_input really that dangerous? We are not evaling something from a file, or from an internet connection. We are evaling something typed in at the
by CJefferson 13y ago
Is evaling raw_input really that dangerous?
We are not evaling something from a file, or from an internet connection. We are evaling something typed in at the keyboard.
Assuming your python isn't setuid root, anyone at the keyboard could just open a new terminal, type 'python', and start evaling raw_input as much as they like.
- bananas 13y agoDoesn't that depend on what's connected to stdin?
- CJefferson 13y agoWell, I suppose if you connected a remote connection to stdin you could have problems, but it still doesn't (to me) feel like a natural "code stink". It is a super easy and quick way to add a REPL or configuration point to any Python program, and I can't think of anything else anywhere near as easy.
- dec0dedab0de 13y agois raw_input the same as stdin? I don't think you can pipe other programs into it.
- eurleif 13y ago>is raw_input the same as stdin? Yes. $ echo foo | python -c 'print raw_input()[::-1]' oof
- dec0dedab0de 13y agoUpvoted. I guess I was thinking more along the lines of one shouldn't use raw_input() when you're expecting a pipe since it only takes one line. $ ps | python -c 'print raw_input()' PID TTY TIME CMD But I suppose you could just loop to get around that anyway.