python magic function eval() learning

    There are many built-in useful tool functions in python. Using these small tools skillfully can definitely help you achieve twice the result with half the effort in your work. Today, because you need to use the eval() function, this function has actually been used before, but because of the Recently, I have been busy reading papers and other things in the direction, and I have gradually forgotten this thing. I will use it today, and I will just learn it directly. It is here as a record of learning.

The functional explanation given in the official documentation of eval() is: convert the string object into a valid expression to participate in the evaluation operation and return the calculation result

Syntax: The call is: eval(expression, globals=None, locals=None ) returns the result of the calculation

in:

    expression is a python expression that participates in the calculation

    globals is an optional parameter. If the set attribute is not None, it must be a dictionary object.

    locals is also an optional object, if the set property is not None, it can be any map object

Python uses namespaces to record the trajectory of variables. The namespace is a dictionary, the key is the variable name, and the value is the variable value.

When a line of code uses the value of variable  x  , Python will go to all available namespaces to find the variable, in the following order:

1) Local namespace - refers specifically to the methods of the current function or class. If the function defines a local variable  x , or an argument  x , Python will use it and stop searching.

2) Global namespace - specific to the current module. If the module defines a variable, function or class named  x  , Python will use it and stop searching.

3) Built-in namespaces - global to each module. As a last resort, Python will assume  x  is a built-in function or variable.

Python's global namespace is stored in a dict object called globals(); local namespaces are stored in a dict object called locals(). We can use print (locals()) to see all the variable names and variable values ​​in the body of the function.

The following briefly demonstrates the use of the eval() function:

#!usr/bin/env python
#encoding:utf-8

import math


def eval_test():
    l='[1,2,3,4,[5,6,7,8,9]]'
    d="{'a':123,'b':456,'c':789}"
    t='([1,3,5],[5,6,7,8,9],[123,456,789])'
    print '--------------------------Conversion started-------------------- ------------'
    print type(l), type(eval(l))
    print type(d), type(eval(d))
    print type(t), type(eval(t))

if __name__=="__main__":
    eval_test()

The running result is:

--------------------------Conversion Begins---------------------- ------------
<type 'str'> <type 'list'>
<type 'str'> <type 'dict'>
<type 'str'> <type 'tuple'>
[Finished in 0.2s]

The simple demonstration above is the conversion effect of eval between string objects and list, dictinoary, and tuple objects

It is known that:

eval() is indeed a very convenient tool, but improper use will also cause serious security problems. Many articles and blogs have analyzed the security of eval(), and I will not discuss it here. More to say, the article will give some good reference materials at the end, if you are interested, you can take a look.

How to avoid the security problems brought by eval()? Here are two suggestions:

1. Write the check function by yourself;

2. Use ast.literal_eval: View DOCUMENT by yourself

refer to:

Python: The Magical Uses and Abuses of eval

python eval()

The magic of Python eval function

Potential risks posed by eval in Python

Analysis of the danger of Python's eval() function


Guess you like

Origin http://43.154.161.224:23101/article/api/json?id=325279852&siteId=291194637