<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 2017-11-07 08:29 AM, אלעזר wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAPw6O2QVe1NKhhtT=Q4RGESKiFz_SDa-BxjqyvejtAp7TJiq1w@mail.gmail.com">
<div dir="ltr">Hi,
<div><br>
</div>
<div>The dangers of eval and exec are obvious and well known to
advanced users, but the availability as built-in functions
makes it too tempting for beginners or even medium-level
programmers. You can see questions about these function pretty
often in stackoverflow (<a
href="https://stackoverflow.com/search?tab=newest&q=eval%20python"
moz-do-not-send="true">roughly once a day</a>, though
sometimes the uses are legitimate).</div>
<div><br>
</div>
<div>Maybe we could start a ten-year process of deprecating the
use of `builtins.eval` (in the docs, and then with warnings)?
`builtins.eval` will be a wrapper to the real evaluation
function, moved to `unsafe.eval` or something obvious like
that, so all you need to do to port your code is to add `from
unsafe import unsafe_eval as eval, unsafe_exec as exec` at the
top of the file; it will be a nice warning to the reader.</div>
<div><br>
</div>
<div>The fact that it is a wrapper will slightly slow it down
and make the stack traces noisier - both are good things, IMO.</div>
<div><br>
</div>
<div>Also, it is unfortunate that `ast.literal_eval` is less
accessible than `builtins.eval`. Giving it an alias in
builtins might make it easier for programmers (and less scary
- "ast" might sound like I need a PhD to use it).</div>
<div><br>
</div>
<div>What do you think?</div>
</div>
</blockquote>
<br>
Please don't!<br>
<br>
exec("def one(x):\n [r] = x\n return r") # who says python doesn't
have one-liners?<br>
<br>
(ofc, some would argue you should use:<br>
<br>
one = (lambda x: (lambda y: y)(*x))<br>
<br>
but I digress)<br>
<br>
<blockquote type="cite"
cite="mid:CAPw6O2QVe1NKhhtT=Q4RGESKiFz_SDa-BxjqyvejtAp7TJiq1w@mail.gmail.com">
<div dir="ltr">
<div><br>
</div>
<div>Elazar</div>
<div><br>
</div>
<div><br>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Python-ideas mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Python-ideas@python.org">Python-ideas@python.org</a>
<a class="moz-txt-link-freetext" href="https://mail.python.org/mailman/listinfo/python-ideas">https://mail.python.org/mailman/listinfo/python-ideas</a>
Code of Conduct: <a class="moz-txt-link-freetext" href="http://python.org/psf/codeofconduct/">http://python.org/psf/codeofconduct/</a>
</pre>
</blockquote>
<br>
</body>
</html>