Skip to content

Do not set eval() globals in ImageMath.unsafe_eval()#9576

Open
radarhere wants to merge 1 commit intopython-pillow:mainfrom
radarhere:eval
Open

Do not set eval() globals in ImageMath.unsafe_eval()#9576
radarhere wants to merge 1 commit intopython-pillow:mainfrom
radarhere:eval

Conversation

@radarhere
Copy link
Copy Markdown
Member

out = builtins.eval(expression, {"__builtins": {"abs": abs}}, args)

The use of {"__builtins": {"abs": abs}} rather than {"__builtins__": {"abs": abs}} looks like a typo from #5923

However, if I abandon it entirely and just use None, nothing breaks, so I suggest that as the cleanest code.

https://docs.python.org/3/library/functions.html#eval

Overriding __builtins__ can be used to restrict or change the available names, but this is not a security mechanism: the executed code can still access all builtins.

@radarhere radarhere changed the title Do not set eval() globals Do not set eval() globals in ImageMath.unsafe_eval() Apr 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant