cval

CVAL

评估的保护层
查看示例·报告错误

安装

我知道许多人不在乎程序背后的动机，所以我将安装放在顶部。

Unix和Mac

python3 -m pip install cval

视窗

py - m pip install cval

关于

一个非常简单的脚本，使用正则表达式来添加一层保护层进行评估。为什么？好吧，我一直看到“评估确实很危险” ，而“评估是一种不良习俗” 。所有这些陈述对它们具有一定的有效性，几乎总是有一种更好的方法来完成您想实现的目标。如果您必须将评估用于公共项目使用CVAL，则CVAL应对“确实是危险的”心态。

利用

我鼓励您打破我的脚本，在这里报告任何错误或漏洞，谢谢！

例子

这些示例纯粹集中在安全上，而是现实世界中实用的例子。

禁用模块导入

 # :NOTE: modules is False by default, and the reason we allow function calls
#        is to see the error given when trying to import a module.
cval ( '__import__("os")' , calls = True , modules = False )

输出：

 cval.IllegalSource: Cval panicked due to an attempted illegal import of the module "os"

允许某些模块

 cval ( '__import__("os")' , allowed_modules = [ "os" ], allowed_calls = [ "import" ])

禁用函数调用

 cval ( 'print("Hello, World!")' , calls = False )

输出：

 cval.IllegalSource: Cval panicked due to an illegal function call in source! Attemped call to "print"

允许某些功能调用

 cval ( 'print("Hello, World!")' , allowed_calls = [ "print" ])

块访问全局变量

 foo = "bar"

def foobar ():
    # :NOTE: `globals` doesn't need to be passed in this case
    #        this is only done here for clarity 
    cval ( 'print(foo)' , globals = globals (), allowed_calls = [ "print" ])  # Will not be able to access "foo"
foobar ()

输出：

 cval.SuspiciousSource: Cval found global variable "foo" in the source, killing for safety.

允许一些访问全局变量

 foo = "bar"

def foobar ():
    cval ( 'print(foo)' , globals = globals (), allowed_global_vars = [ "foo" ], allowed_calls = [ "print" ])
foobar ()

输出：

 bar

允许访问所有全局变量

 foo = "bar"
bar = "foo"

def foobar ():
    cval ( 'print(bar+foo")' , globals = globals (), allowed_global_vars = [ "*" ], allowed_calls = [ "print" ])
foobar ()

输出：

 foobar

块访问本地变量

 def fizzbuzz ():
    fizz = "buzz"
    cval ( 'print(fizz)' , locals = locals ())  # Will not be able to access "fizz"
fizzbuzz ()

输出：

 cval.SuspiciousSource: Cval found local variable "fizz" in the source, killing for safety.

允许一些访问本地变量

 def fizzbuzz ():
    fizz = "buzz"
    cval ( 'print(fizz)' , locals = locals (), allowed_local_vars = [ "fizz" ], allowed_calls = [ "print" ])
fizzbuzz ()

输出：

 buzz

允许访问所有本地变量

 def fizzbuzz ():
    fizz = "buzz"
    buzz = "fizz"
    cval ( 'print(buzz+fizz)' , locals = locals (), allowed_local_vars = [ "*" ], allowed_calls = [ "print" ])
fizzbuzz ()

输出：

 fizzbuzz