Using strings as incomplete bits of code in Python

Question

(please help me clarify the title)

This is what I'd like to do:

s = "'arg1', 'arg2', foo='bar', baz='qux'"
def m(*args, **kwargs):
  return args, kwargs

args, kwargs = m(magic(s))
# args = ['arg1', 'arg2']
# kwargs = {'foo': 'bar', 'baz'='qux'}

What is the definition of magic()?

Parsing the string myself is a last resort since it's fraught with pitfalls (what if arg1 has a comma in it? what if arg2 has quotes in it? etc).

Why do you want to do this? If s comes from the user, any non-horrendously-complicated ways to do this will be full of security risks. — Karl Knechtel
– Karl Knechtel, Commented Sep 23, 2011 at 21:27
@Karl s comes from a configuration file. The bulk of the file is not Pythonic at all, but I'm building in some macro-handling that will benefit from this sort of syntax. — sh-beta
– sh-beta, Commented Sep 24, 2011 at 3:09

Andrew Clark · Accepted Answer · 2011-09-23 21:14:46Z

3

With s and m defined as you have them:

>>> args, kwargs = eval('m(%s)' % s)
>>> args
('arg1', 'arg2')
>>> kwargs
{'foo': 'bar', 'baz': 'qux'}

answered Sep 23, 2011 at 21:14

Andrew Clark

210k36 gold badges285 silver badges310 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

John Percival Hackworth · Accepted Answer · 2011-09-23 21:13:50Z

0

Take a look at eval, but be aware that bad things can happen if you're not careful.

answered Sep 23, 2011 at 21:13

John Percival Hackworth

11.5k2 gold badges31 silver badges38 bronze badges

6 Comments

S.Lott Over a year ago

Python code is entirely source. Bad things can happen by people editing the source. eval() has no more risks than are already inherent in Python.

John Percival Hackworth Over a year ago

The additional bad thing is that you can execute user-provided code if you're not paying attention. This is related to the problem of using input instead of raw_input for user I/O.

S.Lott Over a year ago

Python code is entirely source. You can execute user-provided code at any time. "Paying attention" has no bearing on this. eval() is not evil. Any more than any dynamic, interpreted language is evil.

John Percival Hackworth Over a year ago

I never said that eval is evil. If you accept input from a source outside of the currently executing program that may make into an eval , you have assumed additional risk. Pretending that executable input from outside of the program is the same as known source may lead to "bad things" ranging from sub-opitmal performance to security breaches to software crashes. All programs are entirely source at some level, and all programs that allow for the execution of arbitrary code from arbitrary sources have serious risks that are not shared by programs that does not allow code to be injected.

S.Lott Over a year ago

"All programs are entirely source at some level". True, but not the point here. Python source in .py files and python source as input to eval is equally suspicious. Eval is not evil. Yes, it's a source of crashes. But it's not inherently bad.

|

Collectives™ on Stack Overflow

Using strings as incomplete bits of code in Python

2 Answers 2

Comments

6 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

6 Comments

Your Answer

Sign up or log in

Post as a guest

Related