<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">It is important to bear in mind where the code is being run - if this is something running on a researcher’s own system, they almost certainly have lots of other ways of messing it up. These kind of security vulnerabilities are normally only relevant when you are running code that came from somewhere else.<div class=""><br class=""></div><div class="">That being said, this use case sounds like it could work with the Jupyter notebook. If you want something that is like typing code into a .py file but evaluated at run time instead, why not just use an interactive Python REPL instead of eval(input()).</div><div class=""><br class=""></div><div class="">Ben</div><div class=""><br class=""></div><div><blockquote type="cite" class=""><div class="">On 27 Oct 2016, at 17:52, Benjamin Root <<a href="mailto:ben.v.root@gmail.com" class="">ben.v.root@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div class=""><div class="">"only be used by engineers/scientists for research"<br class=""><br class=""></div>Famous last words. I know plenty of scientists who would love to "do research" with an exposed eval(). Full disclosure, I personally added a security hole into matplotlib thinking I covered all my bases in protecting an eval() statement.<br class=""><br class=""></div>Ben Root<br class=""></div><div class="gmail_extra"><br class=""><div class="gmail_quote">On Thu, Oct 27, 2016 at 4:21 PM, djxvillain <span dir="ltr" class=""><<a href="mailto:djxvillain@gmail.com" target="_blank" class="">djxvillain@gmail.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">This will not be a public product and will only be used by other<br class="">
engineers/scientists for research. I don't think security should be a huge<br class="">
issue, but I appreciate your input and concern for the quality of my code.<br class="">
<br class="">
<br class="">
<br class="">
--<br class="">
View this message in context: <a href="http://numpy-discussion.10968.n7.nabble.com/How-to-use-user-input-as-equation-directly-tp43665p43670.html" rel="noreferrer" target="_blank" class="">http://numpy-discussion.10968.<wbr class="">n7.nabble.com/How-to-use-user-<wbr class="">input-as-equation-directly-<wbr class="">tp43665p43670.html</a><br class="">
<div class="HOEnZb"><div class="h5">Sent from the Numpy-discussion mailing list archive at <a href="http://nabble.com" class="">Nabble.com</a>.<br class="">
______________________________<wbr class="">_________________<br class="">
NumPy-Discussion mailing list<br class="">
<a href="mailto:NumPy-Discussion@scipy.org" class="">NumPy-Discussion@scipy.org</a><br class="">
<a href="https://mail.scipy.org/mailman/listinfo/numpy-discussion" rel="noreferrer" target="_blank" class="">https://mail.scipy.org/<wbr class="">mailman/listinfo/numpy-<wbr class="">discussion</a><br class="">
</div></div></blockquote></div><br class=""></div>
_______________________________________________<br class="">NumPy-Discussion mailing list<br class=""><a href="mailto:NumPy-Discussion@scipy.org" class="">NumPy-Discussion@scipy.org</a><br class="">https://mail.scipy.org/mailman/listinfo/numpy-discussion<br class=""></div></blockquote></div><br class=""></body></html>