eval() (or something as dangerous) with data which I created and stored in
local_file on the machine running my program:
import local_file def f(str_to_eval): # code.... # .... eval(str_to_eval) # .... # .... return None a = f(local_file.some_str)
f() is safe to run since the strings I provide to it are my own.
However, if I ever decide to use it for something unsafe (e.g. user input) things could go terribly wrong. Also, if the
local_file stops being local then it would create a vulnerability since I would need to trust the machine that provides that file as well.
How should I ensure that I never "forget" that this function is unsafe to use (unless specific criteria are met)?
eval() is dangerous and can usually be replaced by something safe.