limited python virtual machine

[Bernhard Herzog]

aleaxit at yahoo.com (Alex Martelli) writes:

> OK then -- vars(type(object)) is a dict which has [[the unbound-method
> equivalent of]] object.__subclasses__ at its entry for key
> '__subclasses__'.  Scratch 'vars' in addition to 'getattr'.  And 'eval'
> of course, or else building up the string 'object.__subclasses__' (in a
> way the regex won't catch) then eval'ing it is easy.  I dunno, maybe I'm
> just being pessimistic, I guess...

You can defeat the regexp without any builtin besides object:

>>> eval("# coding: utf7\n"
         "+AG8AYgBqAGUAYwB0AC4AXwBfAHMAdQBiAGMAbABhAHMAcwBlAHMAXwBf-")
<built-in method __subclasses__ of type object at 0x81010e0>
>>> 

   Bernhard


-- 
Intevation GmbH                                 http://intevation.de/
Skencil                                           http://skencil.org/
Thuban                                  http://thuban.intevation.org/