0

So I am loading some 'code' from a database. it is mostly string representation of some class.

so let says you have a custom class that look like MyClass(name=hello)

my code would look something like this:

import MyClass
string_rep_of_class = 'MyClass(name=hello)'
eval(string_rep_of_class, {'__builtins__': None}, {'MyClass': MyClass})

because I am not exposing bultins and only exposing the local MyClass is there a security issue I am missing or this is a pretty safe approach?

Thanks

Steven G
  • 14,602
  • 6
  • 47
  • 72

0 Answers0