Converting hex string to an integer

[Derek Fountain]

Given the character string "0x00A1B2C3" arriving at sys.argv[1] how do I
convert that to an integer which I can do some math on?

[Alexandre Fayolle]

Le 26-08-2004, Derek Fountain <no****@example.com> a écrit*:

Given the character string "0x00A1B2C3" arriving at sys.argv[1] how do I
convert that to an integer which I can do some math on?

s = "0x00A1B2C3"
int(s, 16)

10597059
--
Alexandre Fayolle LOGILAB, Paris (France).
http://www.logilab.com http://www.logilab.fr http://www.logilab.org

[Rick Holbert]

Derek Fountain wrote:

Given the character string "0x00A1B2C3" arriving at sys.argv[1] how do I
convert that to an integer which I can do some math on?

i = eval(sys.argv[1])

[Peter Hansen]

Rick Holbert wrote:

Derek Fountain wrote:

Given the character string "0x00A1B2C3" arriving at sys.argv[1] how do I
convert that to an integer which I can do some math on?

i = eval(sys.argv[1])

That's dangerous advice to a newbie if not qualified carefully.

Derek, "eval" could be the source of serious security problems
if you don't understand its power. Specifically it should
almost never be used for input that comes from a user or
via the command line. There is pretty much always another
and much better way to do the simple stuff like conversions
than to use eval.

For example, imagine if a malicious could feed your program this:

(on the Linux command line)

$ myscript "__import_('os').system('rm -rf /')"

or the Windows version:

C:\> myscript "__import_('os').system('deltree /y c:\*.*')"

Bye-bye filesystem... (don't run these examples!)

-Peter

[Michael Ströder]

Peter Hansen wrote:

Rick Holbert wrote:

Derek Fountain wrote:

Given the character string "0x00A1B2C3" arriving at sys.argv[1] how do I
convert that to an integer which I can do some math on?

i = eval(sys.argv[1])

That's dangerous advice to a newbie if not qualified carefully.

Derek, "eval" could be the source of serious security problems
if you don't understand its power.

Yes, eval() is risky! Try to get rid of eval() or you MUST protect each and
every call to eval() with paranoid parameter checking!

int(sys.argv[1],16) would be a better approach here...

int("0x00A1B2C3",16) 10597059 int("__import_('os').system('rm -rf /')",16) Traceback (most recent call last):
File "<stdin>", line 1, in ?
ValueError: invalid literal for int(): __import_('os').system('rm -rf /')

Ciao, Michael.

[Michael Hudson]

Peter Hansen <pe***@engcorp.com> writes:

Rick Holbert wrote:

Derek Fountain wrote:

Given the character string "0x00A1B2C3" arriving at sys.argv[1] how do I
convert that to an integer which I can do some math on?

i = eval(sys.argv[1])

That's dangerous advice to a newbie if not qualified carefully.

Derek, "eval" could be the source of serious security problems
if you don't understand its power. Specifically it should
almost never be used for input that comes from a user or
via the command line. There is pretty much always another
and much better way to do the simple stuff like conversions
than to use eval.

For example, imagine if a malicious could feed your program this:

(on the Linux command line)

$ myscript "__import_('os').system('rm -rf /')"

Well, in this situation, he could just type

$ rm -rf /

But, yes.

Cheers,
mwh

--
I'm not particularly fond of singing GSTQ because she stands for
some things I don't, but it's not really worth letting politics
getting in the way of a good bawling. -- Dan Sheppard, ucam.chat

[Peter Hansen]

Michael Hudson wrote:

Peter Hansen <pe***@engcorp.com> writes:

Rick Holbert wrote:

Derek Fountain wrote:

Given the character string "0x00A1B2C3" arriving at sys.argv[1] how do I
convert that to an integer which I can do some math on?

i = eval(sys.argv[1])

That's dangerous advice to a newbie if not qualified carefully.

Derek, "eval" could be the source of serious security problems
if you don't understand its power. Specifically it should
almost never be used for input that comes from a user or
via the command line. There is pretty much always another
and much better way to do the simple stuff like conversions
than to use eval.

For example, imagine if a malicious could feed your program this:

(on the Linux command line)

$ myscript "__import_('os').system('rm -rf /')"

Well, in this situation, he could just type

$ rm -rf /

But, yes.

He could if he were on the same system, but it's quite possible
that sys.argv[1] in this particular program is actually coming
from a remote system in some manner (web?). But, yes. :-)

-Peter