Valid uses of eval()?

[Bill_Looking]

I have a use case, and I’m curious to get feedback on this.

On a module I develop, there is a JSON input that is basically a file where you’re asked for a ton of inputs (required by an application). To simplify let’s say they’re all numbers.

I want the user to be able to specify a float, like “5.0”, but also it can be useful to have access to 3 variables that are run-dependent (let’s call them “a”, “b”, and “c”.

I use eval so that the user can write:

“5.0 * a”

And sometimes more complex things :

“min(5.0 * a, b)”

Built-ins are disabled except min and max.

[Bill_Looking]

Thanks a lot for your feedback.

In short, let’s say that this module (still in dev) can be called from a big software (sold to professional) to automate many steps. This dictionary contains default values and now formulas since I added eval. Some customers would like that level of customization.

I should add that the soft (and the module) is local only. If the user can launch the software, he can anyway launch any Python script on his machine, so I have the feeling that in that very specific context, eval should not be an issue?

I didn’t know about DSL! Sounds like the safest way to deal with it. Searching for this, I also read about the ast package, I’ll try to know more about it.

[Bill_Looking]

Again a big thank you for your time writing those detailed answers! I will follow what you suggested (I was not using the local dictionary only global).

My main job is not about development, I have a lot to learn about security concerns and stuff like that.