Title: rexec.r_eval() does not work like eval()
Type: Stage:
Components: Library (Lib) Versions: Python 2.2
Status: closed Resolution: wont fix
Dependencies: Superseder:
Assigned To: Nosy List: loewis, pfremy
Priority: normal Keywords:

Created on 2004-03-03 09:58 by pfremy, last changed 2004-03-30 21:06 by loewis. This issue is now closed.

Messages (4)
msg20160 - (view) Author: Bluebird (pfremy) Date: 2004-03-03 09:58
I want to use the eval() function of python as simple
ultra-restricted expression evaluator. So, when
executing r_eval(), I want to pass a dictionnary of the
local and global variables, just like it is possible
with eval(). However, r_eval() does not allow it.
msg20161 - (view) Author: Martin v. Löwis (loewis) * (Python committer) Date: 2004-03-29 22:34
Logged In: YES 

The rexec module does not provide restricted execution, so
you should not be using it in the first place.

Closing this as "won't fix".
msg20162 - (view) Author: Bluebird (pfremy) Date: 2004-03-30 07:31
Logged In: YES 
reads: "17.1 rexec -- Restricted execution framework" 
so it looks like the module does provide a "Restricted execution 
framework", no ? 
Now, I assume that you mean that the module has been marked 
obsolete in the most recent of python (which I am not using). 
Is there any replacement available ? 
msg20163 - (view) Author: Martin v. Löwis (loewis) * (Python committer) Date: 2004-03-30 21:06
Logged In: YES 

No, not marked obsolete: "Changed in version 2.3: Disabled

"While the rexec module is designed to perform as described
below, it does have a few known vulnerabilities which could
be exploited by carefully written code. "

Even in 2.2, when it still was enabled, it did not actually
do what it was designed to do, and it is not possible to fix
it. Also, there is no replacement available.
Date User Action Args
2004-03-03 09:58:57pfremycreate