democritus-project / democritus-project/d8s-python

Replace eval() in python_object_properties with getattr (hardening)

Open
#51 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
2
Forks
4
PR merge metrics
No merged PRs in 30d

Description

## Problem

The property-introspection helper in `d8s_python/python_data.py:224` (and the following few lines) builds and evals a string to read/call attributes:

```python
string_to_eval_as_property = "python_object.{}".format(i)
eval_result = eval(string_to_eval_as_property)
...
eval(string_to_eval_as_function)
```

`i` comes from `python_object.__dir__()`, not external input, so this isn't exploitable today. Still worth removing the eval pattern since it's introspection over attribute names, which `getattr` handles directly.

## Fix

```python
eval_result = getattr(python_object, i)
if callable(eval_result):
try:
print(f"{i}: {eval_result()}")
except TypeError:
print(f"{i}: {eval_result}")
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.