STINNER Victor added the comment: Hugo Geoffroy added the comment: > I would like to point out that the changes in `ast.literal_eval` may have > some security risk for code that do not expect this function to return an > object with user-controlled length (for example, with `2**32*'X'`). AFAIK, > this is not possible with the current version of `literal_eval`.
Since the Python compiler doesn't produce ast.Constant, there is no change in practice in ast.literal_eval(). If you found a bug, please open a new issue. > At least [this library](https://pypi.python.org/pypi/serpent) would have a > serious risk of remote DoS : I tried hard to implement a sandbox in Python and I failed: https://lwn.net/Articles/574215/ I don't think that literal_eval() is safe *by design*. ---------- _______________________________________ Python tracker <rep...@bugs.python.org> <http://bugs.python.org/issue11549> _______________________________________ _______________________________________________ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
