Author serhiy.storchaka
Recipients Jeremy.Hylton, Trundle, alex, benjamin.peterson, berker.peksag, brett.cannon, daniel.urban, dmalcolm, eltoder, eric.snow, georg.brandl, gregory.p.smith, inada.naoki, isoschiz, jcon, mark.dickinson, meador.inge, nadeem.vawda, ncoghlan, pconnell, pitrou, pstch, rhettinger, santoso.wijaya, serhiy.storchaka, techtonik, terry.reedy, vstinner
Date 2017-01-31.14:32:55
SpamBayes Score -1.0
Marked as misclassified Yes
Message-id <1485873175.69.0.317361553411.issue11549@psf.upfronthosting.co.za>
In-reply-to
Content
> Since the Python compiler doesn't produce ast.Constant, there is no
change in practice in ast.literal_eval(). If you found a bug, please
open a new issue.

Currently there is no a bug in ast.literal_eval() because the '**' operator is not accepted.

>>> ast.literal_eval("2**2**32")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/serhiy/py/cpython/Lib/ast.py", line 85, in literal_eval
    return _convert(node_or_string)
  File "/home/serhiy/py/cpython/Lib/ast.py", line 84, in _convert
    raise ValueError('malformed node or string: ' + repr(node))
ValueError: malformed node or string: <_ast.BinOp object at 0xb6f2fa4c>

But if move the optimization to AST level this can add a vulnerability to DOS attack. The optimizer should do additional checks first than execute operators that can return too large value or take too much CPU time. Currently this vulnerability have place in the peephole optimizer.
History
Date User Action Args
2017-01-31 14:32:55serhiy.storchakasetrecipients: + serhiy.storchaka, brett.cannon, georg.brandl, rhettinger, terry.reedy, gregory.p.smith, mark.dickinson, ncoghlan, pitrou, vstinner, techtonik, nadeem.vawda, benjamin.peterson, alex, Trundle, inada.naoki, dmalcolm, meador.inge, daniel.urban, Jeremy.Hylton, santoso.wijaya, eltoder, eric.snow, jcon, berker.peksag, pconnell, isoschiz, pstch
2017-01-31 14:32:55serhiy.storchakasetmessageid: <1485873175.69.0.317361553411.issue11549@psf.upfronthosting.co.za>
2017-01-31 14:32:55serhiy.storchakalinkissue11549 messages
2017-01-31 14:32:55serhiy.storchakacreate