0

Let's say the user has installed a python interpreter on their machine/browser, for example, using something like https://github.com/iodide-project/pyodide. I understand not allowing someone to enter in arbitrary code when they don't own the resources, for example doing something like:

exec('while 1: os.fork()')

However, if the user is executing the code on their own machine, is there anything wrong with allowing them to run arbitrary evals and execs, and just telling them "Please use at your own risk"? The use case is we give the user an environment to work with a spreadsheet, and they can enter in formulas using python, and we just 'pass-through' the entered string (in the spreadsheet cell) to their python environment.

3
  • If you are just using basic expressions, there are safe parser libraries you may be able to use instead. – multithr3at3d Dec 27 '20 at 18:18
  • @multithr3at3d thanks, can you suggest any? Or where I may being a search to find a suitable one? – David542 Dec 27 '20 at 21:49
  • 1
    well it depends what type of expressions you are parsing, but look into ast in the stdlib, or maybe pyexpression-eval – multithr3at3d Dec 27 '20 at 23:50
2

If its on their machine then that eliminates a major attack vector but doesnt necessarily eliminate all of them. I would want to make sure that it is indeed them typing in the formula. There are all different types of scenarios to think about here. What if somebody sends them a spreadsheet and they open it up? Will it execute? What if some social engineering is done and somebody cuts and pastes something without knowledge? How educated are your users? What if someone types rm -rf /? Will they lose all of their data? None of these may be applicable but you get the idea. This would really require you to look at the system as a whole and determine what type of things could possibly go wrong and if its worth the risk. My instinct says there is probably a much safer to do what you are trying to do but without seeing the exact design it would be hard to say.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.