0

So I am loading some 'code' from a database. it is mostly string representation of some class.

so let says you have a custom class that look like MyClass(name=hello)

my code would look something like this:

import MyClass
string_rep_of_class = 'MyClass(name=hello)'
eval(string_rep_of_class, {'__builtins__': None}, {'MyClass': MyClass})

because I am not exposing bultins and only exposing the local MyClass is there a security issue I am missing or this is a pretty safe approach?

Thanks

Steven G
  • 16,244
  • 8
  • 53
  • 77

0 Answers0