Timeline for How bad of an idea is it to use Python files as configuration files?
Current License: CC BY-SA 4.0
34 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 30, 2020 at 10:31 | comment | added | Lie Ryan |
This is a very common pattern in Python frameworks and applications. Celery, Django, setuptools, rope (refactoring library), pgAdmin 4 (PostgreSQL GUI), ipython (python shell), qtile (window manager), are just some that comes to mind. There are gotchas of course, IMO setuptools for example should never have used setup.py, but for many applications especially one targeted towards programmers or power users, and one where security/code execution isn't really a issue, it's perfectly fine. Outside of Python, there are programs like Vim and Emacs that uses Turing complete configuration language.
|
|
| Oct 30, 2020 at 9:04 | history | edited | André Christoffer Andersen | CC BY-SA 4.0 |
Removing distracting wording.
|
| Nov 29, 2018 at 0:59 | answer | added | RayLuo | timeline score: 1 | |
| Jun 23, 2017 at 3:37 | history | tweeted | twitter.com/StackSoftEng/status/878094581409005568 | ||
| Jun 20, 2017 at 22:50 | comment | added | mrr | It's the precise opposite of a bad idea | |
| Jun 20, 2017 at 18:39 | comment | added | Kat | Obligatory side mention that JSON doesn't have to be strict. A variety of JSON libraries do support trailing commas and JS-style comments. It won't be compatible for external use, but for a config file, it's great. There's also a variety of other JSON-like config languages, like TypeSafe's config. That's a superset of JSON with a variety of extra features. | |
| Jun 20, 2017 at 13:40 | comment | added | Jules |
Alternatively, there's TOML, which is used in Cargo (Rust) crate configurations, and has a parser available through pip install toml.
|
|
| Jun 20, 2017 at 3:55 | comment | added | user541686 | @AndréChristofferAndersen: One option -- which I've never needed to try -- is to use Python syntax, but restrict it in some way, and interpret the AST yourself instead of evaluating the code. That way you can restrict what the user can and can't do, while still providing more flexibility than, say, JSON. | |
| Jun 20, 2017 at 1:35 | comment | added | madstap | If you don't like JSON, YAML nor XML, you should check out edn. It's similar to JSON, except less verbose (no commas (actually commas are whitespace, so you can put them anywhere)), has richer types (a keyword type with optional namespaces, sets, datetimes), and is extensible with custom types. There's a parser for python. | |
| Jun 19, 2017 at 23:55 | vote | accept | André Christoffer Andersen | ||
| Jun 19, 2017 at 20:04 | comment | added | Scott Mermelstein | If you avoid your last bullet point - adding scripting - then all you're using Python for is "JSON, but more user-friendly". If that's the case, just use ast.literal-eval, and the python interpreter will enforce that the file only has data, with no executable code. I use it in this way, and it's pretty nice. The only problem is if you do make a syntax error, ast.literal_eval won't properly tell you where it is. Hunting it down gets ugly. Note, I don't even save these as .py files - I label them .txt to make the fact that it's non-executable more obvious. | |
| Jun 19, 2017 at 19:10 | comment | added | Casey | @Blrfl Surely the same concerns apply to any program the user has rights to modify, whether or not its configuration is executable. | |
| Jun 19, 2017 at 17:33 | comment | added | chepner | Not enough rep (or practical experience with my suggestion) to answer, but you might be interested in something like Dhall, which is a Turing-incomplete language intended for configuration files. (At this stage in its development, it would have to form part of a two-step process: create and verify your configuration file in Dhall, then convert it to JSON or YAML.) | |
| Jun 19, 2017 at 14:52 | comment | added | 9000 | There is a contradiction between "unskilled users" and "scripting". "Unskilled" users should be given the simplest and most bullet-proof format, like JSON or INI, with all advanced interpretation explicitly limited and controlled by your program. Advanced users could just write a Python module for your program (especially is you allow for extension scripts), without conflating it with config files. | |
| Jun 19, 2017 at 14:51 | comment | added | ivan_pozdeev | Related: stackoverflow.com/questions/40930663/config-file-with-a-py-file | |
| Jun 19, 2017 at 14:45 | history | protected | gnat | ||
| Jun 19, 2017 at 14:35 | comment | added | Dominique |
How does your program react if you put rm -rf /* in the Python configuration script? :-)
|
|
| Jun 19, 2017 at 13:11 | answer | added | Dmitry Grigoryev | timeline score: 1 | |
| Jun 19, 2017 at 10:21 | comment | added | Ben | Use JSON or YAML or similar. If people want the ability to use macros and such in the config, they can achieve that by writing a script to generate the config. | |
| Jun 19, 2017 at 8:16 | answer | added | Matteo Italia | timeline score: 24 | |
| Jun 19, 2017 at 8:05 | answer | added | CodeMonkey | timeline score: 3 | |
| Jun 19, 2017 at 7:47 | comment | added | Christian Sauer | If you dislike JSON, you should try yaml. I like it for configs a lot. especially when larger strings are involved, YAML is waaaay more readable then JSON. | |
| Jun 19, 2017 at 7:34 | answer | added | Basile Starynkevitch | timeline score: 9 | |
| Jun 19, 2017 at 3:10 | comment | added | Ben Crowell | The fundamental issue is that python is Turing-complete and JSON isn't. Thus no program can reliably predict the behavior of a python script. If your IDE seems to understand python, it isn't understanding it in the same sense that software could understand a JSON file. Birfl says: Unskilled isn't your problem. Malicious is. To amplify on this, there are easy automated ways to protect against malicious JSON, but there is no way, even in principle, to give automated protection against malicious python. It sounds like what you really want is a more expressive Turing-incomplete language. | |
| Jun 19, 2017 at 2:15 | comment | added | ChuckCottrill | Use JSON as your configuration. Many languages understand JSON (including Python, so one might argue it is using a subset of Python), it is brief and readable. And you won't be tempted to try to write more complex 'code' in your configuration files. | |
| S Jun 19, 2017 at 0:36 | history | suggested | Peter Mortensen | CC BY-SA 3.0 |
Copy edited (e.g. ref. <http://en.wikipedia.org/wiki/Python_%28programming_language%29>, <http://en.wikipedia.org/wiki/JSON>, <https://en.wiktionary.org/wiki/any_more#Adverb>, <http://en.wikipedia.org/wiki/Git_%28software%29>, and <https://en.wiktionary.org/wiki/American#Adjective>).
|
| Jun 18, 2017 at 20:29 | review | Suggested edits | |||
| S Jun 19, 2017 at 0:36 | |||||
| Jun 18, 2017 at 20:12 | comment | added | Pierre.Sassoulas | There is also Django, a python web-framework, that use python configuration file.It permit to reuse some variable for example a lot of project have the value "ROOT" for the project path and use it for over variable with os.path.join(ROOT, path). | |
| Jun 18, 2017 at 18:55 | answer | added | Celada | timeline score: 55 | |
| Jun 18, 2017 at 12:08 | answer | added | amon | timeline score: 104 | |
| Jun 18, 2017 at 12:06 | review | Close votes | |||
| Jun 22, 2017 at 6:40 | |||||
| Jun 18, 2017 at 11:47 | comment | added | André Christoffer Andersen | @Blrfl True. That's one of my main concerns. Currently, if you can change configurations files you can also change code. The problem I'm seeing is that we in the future have more separation of duties where configuration files get passed between team members, some who are allowed to do coding updates, others who aren't. That's far off, but could be a thing in the future. Python based configuration files will then be a security issue. | |
| Jun 18, 2017 at 11:42 | comment | added | Blrfl | Unskilled isn't your problem. Malicious is. | |
| Jun 18, 2017 at 11:26 | history | asked | André Christoffer Andersen | CC BY-SA 3.0 |