Re: Fix for CVE-2019-17626 python-reportlab
Tim Roberts <[email protected]>
| Newsgroups | gmane.comp.python.reportlab.user |
|---|---|
| Organization | Providenza & Boekelheide, Inc. |
| Message-ID | <[email protected]> |
Marius Gedminas wrote: > > Unfortunately clearing __builtins__ is not enough to make eval() safe: > https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html > > Usually ast.literal_eval() is the best safe replacement if all you need > is ints/floats/tuples/lists. It's also worth pointing out that most Python expressions are valid JSON objects. If your code has a JSON parser, you may be able to reuse that. -- Tim Roberts, [email protected] Providenza & Boekelheide, Inc.
smime.p7s
(application/pkcs7-signature, 3.3 KB) - not displayed