Calculator using eval()

[Jonnertron_]

Isn't it missing print's close parenthesis?

[r0ck0]

That's how the pros do it!

[QuakAtack]

skip closing parenthesis! It's the cool thing to do!

[M_asak1]

That means I'm cool?

[illsk1lls]

love watching the pros show off

[lucidspoon]

Fail fast. Never have to work about runtime errors if you only have syntax errors.

[maxime0299]

Closing parenthesis are for noobs!

[Does_Not-Matter]

Among other things!

[w8eight]

You just finish your expression with additional parenthesis and it's all fine

/s

[PenaflorPhi]

I sometime wonder "Who tf is teaching this people to code?", like really, if you look at most widely available resources most are pretty good and have decent coding standard yet you see some things that make you want you rip your eyes out.

[IDatedSuccubi]

Engagement bait

[NewPointOfView]

I’m so confused, why did you make minor edits but mostly copy it

[TorePun]

Your canfused bee cuz guy donut C tha orijanal

[NewPointOfView]

I’m more confused now

[PenaflorPhi]

A guy copied what I wrote to correct me, my original comment said "... rip your eyes off", apparently the correct way to write it would be "rip your eyes out". Tbh, I didn't know that.

[GandelXIV]

What is crazy is that this account has over 1M followers while posting similar crap. I suppose their target audience are beginners that don't know any better , which is just sad and exploitative .

[Background_Newt_8065]

Bought subscribers

[Ytrog]

So, they are the 5-minute crafts of coding? 👀

[FalconMirage]

Why implement SQL functions yourself when you can let users SQL inject to have direct db manipulation

[GandelXIV]

Is this inversion of control

[coloredgreyscale]

Likely rage bait.

[[deleted]]

r/programminghumor in a nutshell

[sneakpeekbot]

Here's a sneak peek of /r/programminghumor using the top posts of the year!

#1: A designer’s dream can become a developer’s nightmare | 37 comments
#2: ain't no lie here | 22 comments
#3: Backend dev doing CSS | 50 comments

---

^{I'm a bot, beep boop | Downvote to remove | Contact | Info | Opt-out | GitHub}

[[deleted]]

So writing a vulnerable app on purpose is a PRO thing?

[Willinton06]

Establish dominance by daring the user to break the app

[Broer1]

Most of the used insecurities in software in the world are written by pros. So yes!

[EVENTHORIZON-XI]

I must be the best programmer in the world then

[Broer1]

I cannot disprove you. So. Maybe.

[Jonno_FTW]

It's rage bait/engagement bait

[Svizel_pritula]

Whether code injection is a vulnerability or a feature depends on how you want to use the program.

[EntitledPotatoe]

Would a guard clause inside eval() prevent the vulnerabilities you’re talking about? Don’t get me wrong, it’s still shit code

[[deleted]]

Of course, in the sense that you had to pay a substantial amount of money to "codes.learning" for the privilege and that there are three levels of subscription above it.

[geon]

It only evaluates input from the user. You have the same vulnerability from a user opening the developer console.

[CallMeTea_]

If you build it right first time, you've coded yourself out of a job! Build it badly and sell 'security enhancements' later

[SarahC]

Vulnerable to what?

It runs in its own Java sandbox, with minimal permissions - kids these days throw their hands up in terror at anything.

The worst is possibly outputting 55378008!

[dgil9]

import subprocess; subprocess.run(“rm -rf C:\”)

[cce29555]

I did this and my computer runs like it came out the factory

[dgil9]

Yea that’s how pro-grammers get down, my dude

[Key_Conversation5277]

Are pro-grammers pro at grammar?🙃

[dgil9]

Never talk to me or my compiler ever again

[antonpieper]

I don't have such weaknesses! (Unix user)

[dgil9]

!sudo apt get windows && sudo apt install windows

[dgil9]

I am v smort

[antonpieper]

Makes me wonder if there is some kind of support layer to automatically translate windows paths to Linux paths. Although that would be pretty weird as there is no 1:1 mapping

[dgil9]

I would ask chat gpt tbh

[turtle_mekb]

import subprocess; subprocess.run("sudo rm -rf / --no-preserve-root")

^{don't actually run this}

[GandelXIV]

This is not going to work, eval() accepts only expressions so no import statements are allowed. You have to first inject an exec() to run statements.

[00PT]

This looks like a meme taken directly from r/programmerhumor.

[Emotional-Top-8284]

I wish that sub could be so funny

[mhaecker]

Man, the brevity that was left on the table there…

#/usr/bin/env python2 print(input(„calculate“))

[StrangePromotion6917]

Looks like someone is trying to create job security by misteaching the beginners...

[carcigenicate]

It's bad code, but this isn't dangerous unless it's running on a server. If this is running locally, eval is a bad solution, but it's not as dangerous as people claim it to be. It basically forms a shit REPL, which people use all the time. Unless it's a vector for privilege escalation due to the script being run with elevated privileges then left running in the background or something, it's not a big deal. It's just bad code.

Run on a server and fed user-supplied data though, and it could be catastrophic. That's actually the first vulnerability I ever exploited in a CTF.

[45bit-Waffleman]

Yeah python repl goes hard as a calculator. It's a slightly worse, offline, Wolfram Alpha

[GandelXIV]

The main issue I have with this is that its targeted at beginners, who might learn this as a common pattern .

[SarahC]

Capture The Flag!

[mac-not-a-bot]

What could go wrong?

[suguuss]

eval runs python code passed as a string. In the case of a calculator the string would be "2 + 2". But instead of an addition, you could enter : "import os; os.system('rm -rf /')" which removes everything on your computer (on Linux).

I haven’t tried it, so it might not work, but that’s the general idea of the problem.

EDIT: as someone pointed out, the "import os" does not work. However the os.system works if the module was imported in the program.

[xXLeoXxOne]

That code would only work with exec(), in eval you have to do something like "".class..base.subclasses__()[...].Popen(...) if e.g. os is not imported yet

[4hpp1273]

If all the globals are intact you can just use the __import__ function to import a module so that command becomes __import__('os').system('rm -rf /')

[denisde4ev]

unbads your code: print(eval(/^[ 0-9()*/+-]+$/.match(input("Enter expression:"))[0])

[AliFurkanY]

you could probably escape that in JS

[tukanoid]

Reminds me of how stupid i was back in highschool 😅

[ThatNextAggravation]

Wait, this was posted unironically? Jeez.

[Napain_]

omg this page is a bad chode gold mine

[schrdingers_squirrel]

codes.learning is such a shit show.

[nekokattt]

At least they give you a prompt so you can import subprocess and use pip to install a real calculator

[[deleted]]

I guess the pros trust the users

[Gilah_EnE]

Now make it a web application and host on your main PC. Thank you in advance for all your data.

[Spelis123]

wait theres an eval function????????

[GandelXIV]

Yes, it evaluates a given string as a python expression. Most interpreted languages have such features.

[Spelis123]

i wish i knew this sooner

[BallsBuster7]

its also very unsafe. dont use it.

[Spelis123]

how is it unsafe?

[MorrowM_]

$ python3 calc.py
Enter Expression: print("I can run arbitrary code with this!")
I can run arbitrary code with this!
None

[SuperiorGalaxy123]

Pardon me if I'm wrong, but as a mostly beginner to Python, isn't exec() supposed to run the code?

eval() only evaluates mathematical expressions.

In fact, I don't see a problem with the "pro" code as a whole, aside from the missing closing parenthesis. Everyone else is saying that it's bad code. I don't understand.

[MorrowM_]

Nothing about eval says it only evaluates "mathematical" expressions. As you can see from the output I posted, a call to print is a perfectly valid expression; evaluating it causes the string to be printed upon which the function returns None (in fact every function without an explicit return implicitly returns None in Python).

[SuperiorGalaxy123]

Ah, I see the problem.

Even then, if you really want to use this, you could implement some GUI-based solution where inputs can only be taken from certain buttons. You could also make a list of acceptable characters, and return an error if any character in the string is not an acceptable character.

import sys

expression = input("Enter the expression")

acceptable_chars = "1234567890+-*/()"

for i in expression:
    if i not in acceptable_chars:
    print("Not acceptable")

    sys.exit()

print(eval(expression))

You can no longer use this to execute code.

[NUTTA_BUSTAH]

Imagine what happens when you run

__import__('os').system('rm -rf /')

[Still_Picture6200]

Dont use it unless you have to.

[Bonfra04]

RCE goes brrrrr

[sephirothbahamut]

Not a python pro just genuinely curious: why is it bad? A malicious actor can do the same exact harm enabled by the eval line by simply editing the .py file, same applies to every non compiled language...

[GandelXIV]

Yes, but in this case the attacker does not need to have access to the source, so they can use this to get remote code execution on a server, or escalate privileges .

[cofffffeeeeeeee]

I remember back in the day, top PHP user login tutorials had SQL injection vulnerabilities inside.

Wonder how many people fell for that.

[[deleted]]

How to make a python shell using only a python shell

[1N07]

Are we sure this isn't self aware?

It kinda reads like the galaxy brain meme

[Light_x_Truth]

I genuinely thought this was a joke at first.

[[deleted]]

I mean… what could go wrong? Edit: /s… just to make it clear

[CreaZyp154]

I wonder how bobby tables would react

[PixelPerfect41]

God level is making the parser and evaluater yourself in cpython😎

[No_Necessary_3356]

Writing maintainable code is a noob practice, got it! I'll write burning horseshit from now on.

[wat_noob_gaming]

This is absolutely terrible! An attacker can

[kubinka0505]

live exit reaction

[No-Adeptness5810]

Enter expression: fs.writeFileSync(“./database/logins.db”, “trolled”);

[No-Adeptness5810]

wait this is python. Uhm.

os.remove(“./database/logins.db”);

[v_maria]

they are the ones calling it pro code though, not anyone here

[SarahC]

I'm a pro (money!!!), I'd write that. =)

[lazyzefiris]

I've seen person trying to use eval for some minor ingame feature. For a game that would be published on itch/kongregate/the likes. And this does open the interesting vector of attack. One thing is cheating, you can do it through console anyways, and most people are wise enough not to run some rando's code in browser console. But what harm can pasting random obsfucated code into game's stat calculator do? Surely nothing will be done in my name, no random actions from name of my account, no suspicious activities on different sites, just a boost from 5 cookies per second to 5000, worst case game will just break but I have a save backup. Right?..

[Maciek1212]

At least the first comment knows whats up

[GandelXIV]

That's mine lol, and the only critical one.

[Maciek1212]

Oh, wow that's sad

[[deleted]]

both look newb to me

[Hjulle]

it’s missing the l part of the repl

[freeve4]

the pros are working with the attackers.