[issue36022] [Security] logging.config should not use eval()

Logan Jones added the comment: I'd like to work on this during the Pycon sprints -- nosy: +loganasherjones ___ Python tracker ___

[issue36022] [Security] logging.config should not use eval()

Carol Willing added the comment: Assigning this to @Mariatta, to be worked on the mentored sprint at PyCon US Cleveland. -- assignee: -> Mariatta nosy: +Mariatta, willingc ___ Python tracker

[issue36022] [Security] logging.config should not use eval()

Karthikeyan Singaravelan added the comment: Some discussion in issue15452 about using ast.literal_eval instead of eval which I think is the similar to this report. -- nosy: +xtreak ___ Python tracker

[issue36022] [Security] logging.config should not use eval()

STINNER Victor added the comment: The issue has been reported by Alexandre D'Hondt to th PSRT. I only selected Python 3.8 version, since currently, logging.config explicitly *documents* that eval() is used. Example: https://docs.python.org/3/library/logging.config.html#logging.config.listen

[issue36022] [Security] logging.config should not use eval()

Change by STINNER Victor : -- title: logging.config should not use eval() -> [Security] logging.config should not use eval() ___ Python tracker ___