rexec.r_eval() does not work like eval()

[pfremy]

BPO	908936
Nosy	@loewis

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2004-03-30.21:06:14.000>
created_at = <Date 2004-03-03.09:58:57.000>
labels = ['library']
title = 'rexec.r_eval() does not work like eval()'
updated_at = <Date 2004-03-30.21:06:14.000>
user = 'https://bugs.python.org/pfremy'

bugs.python.org fields:

activity = <Date 2004-03-30.21:06:14.000>
actor = 'loewis'
assignee = 'none'
closed = True
closed_date = None
closer = None
components = ['Library (Lib)']
creation = <Date 2004-03-03.09:58:57.000>
creator = 'pfremy'
dependencies = []
files = []
hgrepos = []
issue_num = 908936
keywords = []
message_count = 4.0
messages = ['20160', '20161', '20162', '20163']
nosy_count = 2.0
nosy_names = ['loewis', 'pfremy']
pr_nums = []
priority = 'normal'
resolution = 'wont fix'
stage = None
status = 'closed'
superseder = None
type = None
url = 'https://bugs.python.org/issue908936'
versions = ['Python 2.2']

[pfremy]

I want to use the eval() function of python as simple
ultra-restricted expression evaluator. So, when
executing r_eval(), I want to pass a dictionnary of the
local and global variables, just like it is possible
with eval(). However, r_eval() does not allow it.

[loewis]

Logged In: YES
user_id=21627

The rexec module does not provide restricted execution, so
you should not be using it in the first place.

Closing this as "won't fix".

[pfremy]

Logged In: YES
user_id=233844

http://www.python.org/doc/2.3.3/lib/module-rexec.html
reads: "17.1 rexec -- Restricted execution framework"

so it looks like the module does provide a "Restricted execution
framework", no ?

Now, I assume that you mean that the module has been marked
obsolete in the most recent of python (which I am not using).

Is there any replacement available ?

[loewis]

Logged In: YES
user_id=21627

No, not marked obsolete: "Changed in version 2.3: Disabled
module."

"While the rexec module is designed to perform as described
below, it does have a few known vulnerabilities which could
be exploited by carefully written code. "

Even in 2.2, when it still was enabled, it did not actually
do what it was designed to do, and it is not possible to fix
it. Also, there is no replacement available.