democritus-project / democritus-project/d8s-python
Replace eval() in python_object_properties with getattr (hardening)
- Dominant language
- Python
- Stars
- 2
- Forks
- 4
- PR merge metrics
- No merged PRs in 30d
Description
## Problem
The property-introspection helper in `d8s_python/python_data.py:224` (and the following few lines) builds and evals a string to read/call attributes:
```python
string_to_eval_as_property = "python_object.{}".format(i)
eval_result = eval(string_to_eval_as_property)
...
eval(string_to_eval_as_function)
```
`i` comes from `python_object.__dir__()`, not external input, so this isn't exploitable today. Still worth removing the eval pattern since it's introspection over attribute names, which `getattr` handles directly.
## Fix
```python
eval_result = getattr(python_object, i)
if callable(eval_result):
try:
print(f"{i}: {eval_result()}")
except TypeError:
print(f"{i}: {eval_result}")
```
Contributor guide
Assessment
This issue has not been assessed yet.