ElectricPy
ElectricPy copied to clipboard
Remove Use of `exec` function in `electricpy.sim` Module
Request:
Remove use of the exec function in the electricpy.sim module:
- https://github.com/engineerjoe440/ElectricPy/blob/2da3a350a5cabe3663d276cacacdd4fdac56ef10/electricpy/sim.py#L1041
- https://github.com/engineerjoe440/ElectricPy/blob/2da3a350a5cabe3663d276cacacdd4fdac56ef10/electricpy/sim.py#L1044
tempQstr += ")"
if any(P_strgs[ii:i]):
if verbose: print("Full P-Func Str:",tempPstr)
exec(tempPstr)
if any(Q_strgs[ii:i]):
if verbose: print("Full Q-Func Str:",tempQstr)
exec(tempQstr)
ii = i # Increase Lower Index
retset = (P_funcs,Q_funcs)
Reason:
Python's exec function is invariably a bit risky, and introduces the opportunity for malicious misuse of code. Though unlikely, it's always possible for some cleverly crafted strings be used to execute arbitrary code. I can't think of a particular way this could be exploited today, but just because I can't think of a way it might be done doesn't mean someone else won't, either.
References:
- https://blog.finxter.com/python-exec/
- https://stackoverflow.com/questions/9672791/how-to-safely-use-exec-in-python