Skip to content

Commit 00e5ec0

Browse files
DanielRufEclips4JelleZijlstra
authored
gh-118633: Add warning regarding the unsafe usage of eval and exec (GH-118437)
* Add warning regarding the unsafe usage of eval * Add warning regarding the unsafe usage of exec * Move warning under parameters table * Use suggested shorter text Co-authored-by: Jelle Zijlstra <[email protected]> * Use suggested shorter text Co-authored-by: Jelle Zijlstra <[email protected]> * Improve wording as suggested --------- Co-authored-by: Kirill Podoprigora <[email protected]> Co-authored-by: Jelle Zijlstra <[email protected]>
1 parent d4b6d84 commit 00e5ec0

File tree

1 file changed

+10
-0
lines changed

1 file changed

+10
-0
lines changed

Doc/library/functions.rst

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -594,6 +594,11 @@ are always available. They are listed here in alphabetical order.
594594
:returns: The result of the evaluated expression.
595595
:raises: Syntax errors are reported as exceptions.
596596

597+
.. warning::
598+
599+
This function executes arbitrary code. Calling it with
600+
user-supplied input may lead to security vulnerabilities.
601+
597602
The *expression* argument is parsed and evaluated as a Python expression
598603
(technically speaking, a condition list) using the *globals* and *locals*
599604
mappings as global and local namespace. If the *globals* dictionary is
@@ -650,6 +655,11 @@ are always available. They are listed here in alphabetical order.
650655

651656
.. function:: exec(source, /, globals=None, locals=None, *, closure=None)
652657

658+
.. warning::
659+
660+
This function executes arbitrary code. Calling it with
661+
user-supplied input may lead to security vulnerabilities.
662+
653663
This function supports dynamic execution of Python code. *source* must be
654664
either a string or a code object. If it is a string, the string is parsed as
655665
a suite of Python statements which is then executed (unless a syntax error

0 commit comments

Comments
 (0)