cval

CVAL

評估的保護層
查看示例·報告錯誤

安裝

我知道許多人不在乎程序背後的動機，所以我將安裝放在頂部。

Unix和Mac

python3 -m pip install cval

視窗

py - m pip install cval

關於

一個非常簡單的腳本，使用正則表達式來添加一層保護層進行評估。為什麼？好吧，我一直看到“評估確實很危險” ，而“評估是一種不良習俗” 。所有這些陳述對它們具有一定的有效性，幾乎總是有一種更好的方法來完成您想實現的目標。如果您必須將評估用於公共項目使用CVAL，則CVAL應對“確實是危險的”心態。

利用

我鼓勵您打破我的腳本，在這里報告任何錯誤或漏洞，謝謝！

例子

這些示例純粹集中在安全上，而是現實世界中實用的例子。

禁用模塊導入

 # :NOTE: modules is False by default, and the reason we allow function calls
#        is to see the error given when trying to import a module.
cval ( '__import__("os")' , calls = True , modules = False )

輸出：

 cval.IllegalSource: Cval panicked due to an attempted illegal import of the module "os"

允許某些模塊

 cval ( '__import__("os")' , allowed_modules = [ "os" ], allowed_calls = [ "import" ])

禁用函數調用

 cval ( 'print("Hello, World!")' , calls = False )

輸出：

 cval.IllegalSource: Cval panicked due to an illegal function call in source! Attemped call to "print"

允許某些功能調用

 cval ( 'print("Hello, World!")' , allowed_calls = [ "print" ])

塊訪問全局變量

 foo = "bar"

def foobar ():
    # :NOTE: `globals` doesn't need to be passed in this case
    #        this is only done here for clarity 
    cval ( 'print(foo)' , globals = globals (), allowed_calls = [ "print" ])  # Will not be able to access "foo"
foobar ()

輸出：

 cval.SuspiciousSource: Cval found global variable "foo" in the source, killing for safety.

允許一些訪問全局變量

 foo = "bar"

def foobar ():
    cval ( 'print(foo)' , globals = globals (), allowed_global_vars = [ "foo" ], allowed_calls = [ "print" ])
foobar ()

輸出：

 bar

允許訪問所有全局變量

 foo = "bar"
bar = "foo"

def foobar ():
    cval ( 'print(bar+foo")' , globals = globals (), allowed_global_vars = [ "*" ], allowed_calls = [ "print" ])
foobar ()

輸出：

 foobar

塊訪問本地變量

 def fizzbuzz ():
    fizz = "buzz"
    cval ( 'print(fizz)' , locals = locals ())  # Will not be able to access "fizz"
fizzbuzz ()

輸出：

 cval.SuspiciousSource: Cval found local variable "fizz" in the source, killing for safety.

允許一些訪問本地變量

 def fizzbuzz ():
    fizz = "buzz"
    cval ( 'print(fizz)' , locals = locals (), allowed_local_vars = [ "fizz" ], allowed_calls = [ "print" ])
fizzbuzz ()

輸出：

 buzz

允許訪問所有本地變量

 def fizzbuzz ():
    fizz = "buzz"
    buzz = "fizz"
    cval ( 'print(buzz+fizz)' , locals = locals (), allowed_local_vars = [ "*" ], allowed_calls = [ "print" ])
fizzbuzz ()

輸出：

 fizzbuzz