gh-118633: Add warning regarding the unsafe usage of eval and exec

[DanielRuf]

---

📚 Documentation preview 📚: https://cpython-previews--118437.org.readthedocs.build/

• Issue: add warning for eval and exec (unsafe usage may lead to critical vulnerabilities) #118633

[ghost]

All commit authors signed the Contributor License Agreement.

[DanielRuf]

For more context, Liran Tal from Snyk posted the following on LinkedIn: https://snyk.io/de/blog/code-injection-vulnerabilities-caused-by-generative-ai/

So I opened this PR to discuss and improve the documentation concerning this matter.

[DanielRuf]

Should there also be some warning for exec?

[Eclips4]

FYI, There's already an entry in faq/programming.

[DanielRuf]

@Eclips4 thanks for the hint, but in my opinion this is not sufficient. Take a look at these:

https://www.php.net/manual/en/function.eval.php
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval

I doubt that anyone reading a documentation entry knows, that there is a separate page with an important information. The warning should be directly in the documentation.

[JelleZijlstra]

Agree that exec() and eval() should carry big red warnings in the docs; it's a bit surprising that they don't, when the considerably safer ast.literal_eval does (https://docs.python.org/3.13/library/ast.html#ast.literal_eval).

Please add a warning to both eval() and exec(). Also, please open an issue to link this PR to: usually that's not necessary for docs fixes, but I think this is important enough that it's good to add a bit more visibility.

[DanielRuf]

I've added now the warning for exec too. Creating the issue now.

[Eclips4]

LG for me. However there is one thing that I want to discuss: Do we need to add a similar note for the compile function?

[willingc]

Thanks everyone for the PR, reviews and suggestions. I'm planning to merge.

[miss-islington-app]

Thanks @DanielRuf for the PR, and @willingc for merging it 🌮🎉.. I'm working now to backport this PR to: 3.12, 3.13.
🐍🍒⛏🤖

[miss-islington-app]

Sorry, @DanielRuf and @willingc, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 00e5ec0d35193c1665e5c0cfe5ef82eed270d0f4 3.12

[bedevere-app]

GH-126161 is a backport of this pull request to the 3.13 branch.

[brianschubert]

@willingc I can make the 3.12 backport if that would be helpful

[willingc]

Thanks @brianschubert. Ping me if you run into any issues.

[bedevere-app]

GH-126162 is a backport of this pull request to the 3.12 branch.