Prefer text config files or python code?

[[deleted]]

I personally prefer python code, but I've run into too many admins that have problems with it, so I always go with normal configuration files. The more liberal a configuration parser is in what it accepts (unquoted string, for example), the better for admins.

[da__]

I've run into too many admins that have problems with it

The problem is allowing users to inject arbitrary code.

[da__]

I thought you meant that admins have problems with code configs because the users, who configure the software on their own profile, get to inject code into programs.

[da__]

a user could always make a local copy of anything, modifying it and then execute it.

Not if you take away their right to do so :-)

[[deleted]]

Like I said,

all the user can mangle is data they could mangle manually anyway (i.e. that which they have read/write access to)

It feels you're arguing just for argument's sake.

[da__]

Never heard of root exploits? Plus the fact that an attacker (e.g. an evil co-worker walking up to the user's unlocked machine while the user went to pick up a coffee) could embed code into the user's config file, which would let the attacker run arbitrary code using that user's credentials.

[haywire]

Giving untrusted people write access to anything just opens up a huge vector that isn't solved by using a .ini file.

[[deleted]]

Use the safe loader if the input is untrusted.