ElectricPy icon indicating copy to clipboard operation
ElectricPy copied to clipboard

Remove Use of `exec` function in `electricpy.sim` Module

Open engineerjoe440 opened this issue 3 years ago • 0 comments

Request:

Remove use of the exec function in the electricpy.sim module:

  • https://github.com/engineerjoe440/ElectricPy/blob/2da3a350a5cabe3663d276cacacdd4fdac56ef10/electricpy/sim.py#L1041
  • https://github.com/engineerjoe440/ElectricPy/blob/2da3a350a5cabe3663d276cacacdd4fdac56ef10/electricpy/sim.py#L1044
        tempQstr += ")"
        if any(P_strgs[ii:i]):
            if verbose: print("Full P-Func Str:",tempPstr)
            exec(tempPstr)
        if any(Q_strgs[ii:i]):
            if verbose: print("Full Q-Func Str:",tempQstr)
            exec(tempQstr)
        ii = i # Increase Lower Index
    retset = (P_funcs,Q_funcs)

Reason:

Python's exec function is invariably a bit risky, and introduces the opportunity for malicious misuse of code. Though unlikely, it's always possible for some cleverly crafted strings be used to execute arbitrary code. I can't think of a particular way this could be exploited today, but just because I can't think of a way it might be done doesn't mean someone else won't, either.

References:

  • https://blog.finxter.com/python-exec/
  • https://stackoverflow.com/questions/9672791/how-to-safely-use-exec-in-python

engineerjoe440 avatar Feb 09 '22 15:02 engineerjoe440