diff options
| author | Daniel Ruf <daniel@daniel-ruf.de> | 2024-10-30 00:36:18 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-10-30 00:36:18 (GMT) |
| commit | 00e5ec0d35193c1665e5c0cfe5ef82eed270d0f4 (patch) | |
| tree | 7430b033e0fe9bfdb78ca14b70931e5646761f6c /Doc/library | |
| parent | d4b6d84cc84029b598fc24b2d0cea543ee63bf84 (diff) | |
| download | cpython-00e5ec0d35193c1665e5c0cfe5ef82eed270d0f4.zip cpython-00e5ec0d35193c1665e5c0cfe5ef82eed270d0f4.tar.gz cpython-00e5ec0d35193c1665e5c0cfe5ef82eed270d0f4.tar.bz2 | |
gh-118633: Add warning regarding the unsafe usage of eval and exec (GH-118437)
* Add warning regarding the unsafe usage of eval
* Add warning regarding the unsafe usage of exec
* Move warning under parameters table
* Use suggested shorter text
Co-authored-by: Jelle Zijlstra <jelle.zijlstra@gmail.com>
* Use suggested shorter text
Co-authored-by: Jelle Zijlstra <jelle.zijlstra@gmail.com>
* Improve wording as suggested
---------
Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
Co-authored-by: Jelle Zijlstra <jelle.zijlstra@gmail.com>
Diffstat (limited to 'Doc/library')
| -rw-r--r-- | Doc/library/functions.rst | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/Doc/library/functions.rst b/Doc/library/functions.rst index 290c638..5c0efd2 100644 --- a/Doc/library/functions.rst +++ b/Doc/library/functions.rst @@ -594,6 +594,11 @@ are always available. They are listed here in alphabetical order. :returns: The result of the evaluated expression. :raises: Syntax errors are reported as exceptions. + .. warning:: + + This function executes arbitrary code. Calling it with + user-supplied input may lead to security vulnerabilities. + The *expression* argument is parsed and evaluated as a Python expression (technically speaking, a condition list) using the *globals* and *locals* mappings as global and local namespace. If the *globals* dictionary is @@ -650,6 +655,11 @@ are always available. They are listed here in alphabetical order. .. function:: exec(source, /, globals=None, locals=None, *, closure=None) + .. warning:: + + This function executes arbitrary code. Calling it with + user-supplied input may lead to security vulnerabilities. + This function supports dynamic execution of Python code. *source* must be either a string or a code object. If it is a string, the string is parsed as a suite of Python statements which is then executed (unless a syntax error |