473,386 Members | 1,823 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 473,386 software developers and data experts.

Safe eval, or how to get list from string

I've to use ConfigParser.

It returns values that are exactly in the config file, so get string
variables like:
int1 with quotes and characers: "42"
this is easy to convert to int:
realint = int(int1)

I've read the tutorial, and the FAQ, and not sure if I missed it, but
other than calling eval (which everyone says is unsafe), I don't know
if there is another way to do this:
string1 has "this is a string" or however complex a string (""" aaa
""").
I can do
realstring = eval(string1)
or
if there is list1 = "[ 'filea', 'fileb', ]", I can get at list by
doing:
reallist = eval(list1)

is there an easier/simpler method of doing the same thing as realstring
and reallist lines above?

Jul 19 '05 #1
6 2291
bwooste...@gmail.com wrote:
if there is list1 = "[ 'filea', 'fileb', ]", I can get at list by
doing:
reallist = eval(list1)
is there an easier/simpler method of doing the same thing as realstring and reallist lines above?


http://twistedmatrix.com/users/moshez/unrepr.py

Example:
from unrepr import unrepr
unrepr("[ 'filea', 'fileb', ]")

['filea', 'fileb']

Jul 19 '05 #2
bw********@gmail.com wrote:
I've to use ConfigParser.

It returns values that are exactly in the config file, so get string
variables like:
int1 with quotes and characers: "42"
this is easy to convert to int:
realint = int(int1)

I've read the tutorial, and the FAQ, and not sure if I missed it, but
other than calling eval (which everyone says is unsafe), I don't know
if there is another way to do this:
string1 has "this is a string" or however complex a string (""" aaa
""").
I can do
realstring = eval(string1)
or
if there is list1 = "[ 'filea', 'fileb', ]", I can get at list by
doing:
reallist = eval(list1)

is there an easier/simpler method of doing the same thing as realstring
and reallist lines above?

See: http://aspn.activestate.com/ASPN/Coo.../Recipe/364469

Michael

Jul 19 '05 #3
> http://twistedmatrix.com/users/moshez/unrepr.py
http://aspn.activestate.com/ASPN/Coo.../Recipe/364469


Thanks, this helps - but I was looking at using no additional modules,
or using something that came bundled in with python 2.3

I just discovered mx.Tools.NewBuiltins

It has something called "reval" looks that would fit my needs
perfectly.

Details:
http://www.faqts.com/knowledge_base/...d/4550/fid/538

Jul 19 '05 #4
bw********@gmail.com wrote:
http://twistedmatrix.com/users/moshez/unrepr.py
http://aspn.activestate.com/ASPN/Coo.../Recipe/364469


Thanks, this helps - but I was looking at using no additional modules,
or using something that came bundled in with python 2.3

I just discovered mx.Tools.NewBuiltins

It has something called "reval" looks that would fit my needs
perfectly.

Details:
http://www.faqts.com/knowledge_base/...d/4550/fid/538

If I remember correctly reval and it's brothers were deemed insecure,
are no longer developed, and are present only for sake of backwards
compatibility. See the global module index entry on it.
Jul 19 '05 #5
Joseph Garvin wrote:
bw********@gmail.com wrote:
It has something called "reval" looks that would fit my needs
perfectly.

Details:
http://www.faqts.com/knowledge_base/...d/4550/fid/538


If I remember correctly reval and it's brothers were deemed insecure,
are no longer developed, and are present only for sake of backwards
compatibility. See the global module index entry on it.


I believe some of the old security holes have been patched. See my
recent post at:

http://mail.python.org/pipermail/pyt...ay/281032.html

My understanding though is that it's still not considered appropriate
for production use.

STeVe
Jul 19 '05 #6
bw********@gmail.com writes:
I've to use ConfigParser.

It returns values that are exactly in the config file, so get string
variables like:
int1 with quotes and characers: "42"
this is easy to convert to int:
realint = int(int1)
There's already a method getint() for that, you can just say

cfgparser.getint('section', 'int1')
if there is list1 = "[ 'filea', 'fileb', ]", I can get at list by
doing:
reallist = eval(list1)


Are you sure you need to use ConfigParser for that? If you need to have
persistent Python data structures, I'd suggest marshalling data and using
(c)Pickle or similar.

--
# Edvard Majakari Software Engineer
# PGP PUBLIC KEY available Soli Deo Gloria!

"Debugging is twice as hard as writing the code in the firstplace. Therefore,
if you write the code as cleverly as possible, you are, by definition,
not smart enough to debug it." -- Brian W. Kernighan
Jul 19 '05 #7

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

42
by: Irmen de Jong | last post by:
Pickle and marshal are not safe. They can do harmful things if fed maliciously constructed data. That is a pity, because marshal is fast. I need a fast and safe (secure) marshaler. Is xdrlib the...
18
by: Joe Fallon | last post by:
I have some complex logic which is fairly simply to build up into a string. I needed a way to Eval this string and return a Boolean result. This code works fine to achieve that goal. My...
15
by: manstey | last post by:
Hi, I have a text file called a.txt: # comments I read it using this:
8
by: FAQ server | last post by:
----------------------------------------------------------------------- FAQ Topic - When should I use eval? ----------------------------------------------------------------------- The ` eval() `...
0
by: J. Clifford Dyer | last post by:
On Tue, 2007-12-11 at 16:55 -0800, katie smith wrote: Katie, First, please provide a useful subject heading when posting to the list. It makes everyone's life easier when searching the...
7
by: bvdp | last post by:
Is there a simple/safe expression evaluator I can use in a python program. I just want to pass along a string in the form "1 + 44 / 3" or perhaps "1 + (-4.3*5)" and get a numeric result. I can...
7
by: bvdp | last post by:
I'm finding my quest for a safe eval() quite frustrating :) Any comments on this: Just forget about getting python to do this and, instead, grab my set of values (from a user supplied text file)...
3
by: Warren DeLano | last post by:
I would like to parse arbitrary insecure text string containing nested Python data structures in eval-compatible form: # For example, given a "config.txt" such as: { 'my_atom' : 1.20,...
0
by: Chris Rebert | last post by:
On Wed, Oct 8, 2008 at 5:34 PM, Warren DeLano <warren@delsci.comwrote: Assuming the data structures are sufficiently basic, i.e. no class instanciations, you can just use the json (AKA...
0
by: taylorcarr | last post by:
A Canon printer is a smart device known for being advanced, efficient, and reliable. It is designed for home, office, and hybrid workspace use and can also be used for a variety of purposes. However,...
0
by: Charles Arthur | last post by:
How do i turn on java script on a villaon, callus and itel keypad mobile phone
0
by: aa123db | last post by:
Variable and constants Use var or let for variables and const fror constants. Var foo ='bar'; Let foo ='bar';const baz ='bar'; Functions function $name$ ($parameters$) { } ...
0
by: ryjfgjl | last post by:
In our work, we often receive Excel tables with data in the same format. If we want to analyze these data, it can be difficult to analyze them because the data is spread across multiple Excel files...
1
by: Sonnysonu | last post by:
This is the data of csv file 1 2 3 1 2 3 1 2 3 1 2 3 2 3 2 3 3 the lengths should be different i have to store the data by column-wise with in the specific length. suppose the i have to...
0
marktang
by: marktang | last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However,...
0
by: Hystou | last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can...
0
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers,...
0
jinu1996
by: jinu1996 | last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.