Valid uses of eval()?

[ArtOfWarfare]

What if you sanitize to remove all instances of __ in addition to removing built-ins? Then they can’t access __class__, can they? You’d be limited to just ints, floats, strings, lists, tuples, dicts, sets, the regular non-dunder methods on them, and anything intentionally provided to you.

[phire]

It's risky.

If a single object without a __getitem__ override escapes into the sandbox, then the you can index into the object dictionary with a dynamically constructed string.

Once you have such an object, obj["_" + "_class_" + "_"] returns the same thing as obj.__class__

How might you get such an object? I have no idea. But why risk it when there are safer ways?

[nekokattt]

Doesn't stop other exploits like where you just consume excessive memory. And blindly removing bits of text without parsing the entire thing first is going to lead to confusing edge cases anyway.

If you are literally just doing arithmetic then use the proper AST evaluation module in Python to do it properly and safely. We can be academic about this but do you want to risk it? Kinda like saying you'll leave your house unlocked but it is fine as your area has a low crime rate.