7 ms·
http://docs.python.org/2/library/functions.html#eval http://docs.python.org/2/library/functions.html#eval
by devgutt 13y ago
http://docs.python.org/2/library/functions.html#eval http://docs.python.org/2/library/functions.html#eval
- echohack 13y agohttps://github.com/thijsdezoete/noevil https://github.com/thijsdezoete/noevil
- deadreturns2 13y agoHe's talking about the preg_replace /e modifier not eval, the function.
- valleyer 13y agonote: “... in replace function”
- pjscott 13y agoYes, Python has eval, but it doesn't hide in the bushes and ambush you. The same can not be said for preg_replace and the /e option.
- Dylan16807 13y agoJust curious, how many points does your comment have right now even though it's completely wrong? I'm not insulting you for making a tiny mistake, I'm wondering why a 7 hour old post with multiple 6 hour old corrections attached to it still has a positive score.
- devgutt 13y agobecause eval is the real source of the problem
- Dylan16807 13y agoWould you remove the ability to load libraries, too? Because that's as dangerous as eval when it comes to purposely writing code to run external commands. The ability of a programming language to run code is not the cause of the problem, it's having domain-breaking misleading functions like a string replacer that can compile and execute.
- devgutt 13y agoyeah because libraries, which is available for scrutiny of a community (and you), is the same as a function that can run any arbitrary code in your program at runtime.
- Dylan16807 13y agoIf you can load libraries at runtime, you can load a secret malicious library, or replace a standard library with arbitrary code before triggering the loading. So would you remove that ability to avoid its exploitation potential by malware?