B307.md

Pattern: Avoid using eval() when possible

Issue: -

Description

Used when you use the eval() function, to discourage its usage. It's usage may have negative readability, performance and security implications, especially if you accept strings from untrusted or unknown sources. Consider using ast.literal_eval() for safely evaluating strings containing expressions from untrusted sources.

Example of insecure code:

eval('os.listdir(".")')

Example of secure code:

ast.literal_eval('os.listdir(".")')

Further Reading

• The Python Standard Library - eval()
• Ned Batchelder - Eval really is dangerous
• Bandit - B307: eval