Safely eval Python syntax using the AST module
summary
Claims a safe eval pipeline that parses user Python into the AST module, rejects disallowed node types by whitelist nodes, limits call targets (only specific string methods and a small allowed name set), and either executes against a minimal environment or rewrites the tree to transform tree to custom code. Production use includes bank event/rule matching with permission checks and altered equality semantics for None; pen testing passes but deeply nested input can cause stack/recursion failures so size limits are required.
AI-written summary · about
chapters (13)
- 0:00Intro
- 2:40Bank use case
- 3:40Good uses
- 4:20Dangerous uses
- 5:00What does it do
- 5:40What could happen
- 7:35Syntax tree
- 9:10What are you trying to protect
- 10:20Code example
- 16:00Permissions
- 16:25Generating code
- 17:00Security considerations
- 18:00Audience questions
related talks
17mUnlocking Python's AST: The Metaprogramming Superpower You Didn't Know You Had
24mThe AST and Me
32mCode as Data_ A Practical Introduction to Python’s Abstract Syntax Tree
34mFinding and creating gambiarras with python ASTs
36mHacking the Python AST
31mSupercharge your Python library using AST parsing
22mDecoding: programming beyond text files
25mPython as a Hackable Language for Interactive Data Science