Skip to content

Commit 1d11b8e

Browse files
DanielRufEclips4JelleZijlstra
authored andcommitted
[3.12] pythongh-118633: Add warning regarding the unsafe usage of eval and exec (pythonGH-118437)
* Add warning regarding the unsafe usage of eval * Add warning regarding the unsafe usage of exec * Move warning under parameters table * Use suggested shorter text Co-authored-by: Jelle Zijlstra <[email protected]> * Use suggested shorter text Co-authored-by: Jelle Zijlstra <[email protected]> * Improve wording as suggested --------- (cherry picked from commit 00e5ec0) Co-authored-by: Daniel Ruf <[email protected]> Co-authored-by: Kirill Podoprigora <[email protected]> Co-authored-by: Jelle Zijlstra <[email protected]>
1 parent 7812dc3 commit 1d11b8e

File tree

1 file changed

+10
-0
lines changed

1 file changed

+10
-0
lines changed

Doc/library/functions.rst

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -588,6 +588,11 @@ are always available. They are listed here in alphabetical order.
588588
:returns: The result of the evaluated expression.
589589
:raises: Syntax errors are reported as exceptions.
590590

591+
.. warning::
592+
593+
This function executes arbitrary code. Calling it with
594+
user-supplied input may lead to security vulnerabilities.
595+
591596
The *expression* argument is parsed and evaluated as a Python expression
592597
(technically speaking, a condition list) using the *globals* and *locals*
593598
dictionaries as global and local namespace. If the *globals* dictionary is
@@ -634,6 +639,11 @@ are always available. They are listed here in alphabetical order.
634639

635640
.. function:: exec(object, globals=None, locals=None, /, *, closure=None)
636641

642+
.. warning::
643+
644+
This function executes arbitrary code. Calling it with
645+
user-supplied input may lead to security vulnerabilities.
646+
637647
This function supports dynamic execution of Python code. *object* must be
638648
either a string or a code object. If it is a string, the string is parsed as
639649
a suite of Python statements which is then executed (unless a syntax error

0 commit comments

Comments
 (0)