Skip to content

Instantly share code, notes, and snippets.

@jul
Last active August 29, 2015 14:19
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save jul/052b7862439aca58189d to your computer and use it in GitHub Desktop.
Save jul/052b7862439aca58189d to your computer and use it in GitHub Desktop.
about a discussion at pycon and the existence of a «secured reduced shell»
#!/usr/bin/env python
def aval(xstr):
""" eval a string with all builtins from the interpreter forbidden & no
globals"""
print "".join(["*" * 20, "<", xstr, ">", "*" * 20])
try:
print "'safe' EVAL"
print eval( xstr,{'__builtins__':{}},{})
except Exception as e:
print "!%s not usable %r" % (xstr,e)
pass
print "\n"
t = lambda *p:"\n".join(list(p) + [ "*" *80, "" ])
print t("problematic")
aval("""[
c for c in ().__class__.__base__.__subclasses__() if c.__name__ == 'catch_warnings'
][0]()._module.__builtins__""")
print t("more problematic")
aval("[ i * 2 for i in 'lklmk']")
aval(""" ";)" *100 """)
aval(""" "%2000000.200000f" % 0.0 """)
aval("""len( "%2000000.200000f" % 0.0) """)
aval(""" (2**2**2**2**2).__sizeof__()""")
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment