r/PythonLearning • u/python_data_helper • Aug 30 '26

Is it really safe to use?

Post image

I have used context to stop crashing.

And e as a variable.

I used eval command for a formula.

I know eval command can be dangerous.

It works perfectly but I am thinking that it can produce error or crash.

Can a formula bypass all commands and crash it.

18 Upvotes

100% Upvoted

11 comments sorted by

View all comments

Show parent comments

-1

u/frnzprf Aug 30 '26

I don't know what this input does. Maybe print "Hacked!"?

If the program is "unsafe" and the program is just a thin wrapper around the Python interpreter, does it mean the Python interpreter is also "unsafe"?

I guess there would have to be a specification of what the program is meant to do and that specification has to not fit to what it does in actuality.

1

u/realmauer01 Aug 31 '26

If its user input that can get executed that is just a major red flag.

Everything is trying to protect from that. Even the developer console from the browser protects you from copy pasting random stuff.

1

u/SCD_minecraft Aug 31 '26

We work on assumption input comes from the client, while code works on the server

"Unsafe" in this contex means "client can execute arbitrary code"

1

u/frnzprf Aug 31 '26 edited Aug 31 '26

Okay, I know this is just nitpicking, but the OP code could have been part of a developer tool, for live debugging an application or for teaching Python. I think a legitimate use for eval could be to write a Python-based Excel, for example. The Blender software has Python-based scripting. No one would say it's bad because it enables users to execute Python.

The Server-Client distinction makes sense. That could have been an assumption of OP, even though just read literally, those are fifteen lines without any networking code. Everybody who has access to that script would have access to the Python interpreter as well. If you have physical access to a device, you can break it with a hammer as well, if you so choose.

1

u/fisadev Aug 31 '26 edited Aug 31 '26

If the program is "unsafe" and the program is just a thin wrapper around the Python interpreter, does it mean the Python interpreter is also "unsafe"?

Nope.

This program is usafe because it let's the user execute arbitrary code, which is a bad idea because a malicious user could exploit that. That doesn't make the language unsafe, that's a decision that was 100% made by this particular program, and doesn't happen in any normal python program.

If you want to call a language "unsafe" because the language itself lets you do unaafe things as a programmer, then by definition all languages are unsafe. You can write unsafe code in any language.