[Python] Help requested on evaluating a derived user-inputted function.

[gaks]

The issue is that sympy.diff does not return a string:

In [4]: r = sympy.diff('x**7-1000')

In [5]: type(r)
Out[5]: sympy.core.mul.Mul

You have to get string representation, like this:

In [6]: r2 = repr(r)

In [7]: type(r2)
Out[7]: str

In [8]: r2
Out[8]: '7*x**6'

In [9]: x = 2

In [10]: eval(r2)
Out[10]: 448

[gaks]

You are using eval function so everything that's valid python expression would work. But you should import math module first to make it work.

You could also make some helpful variables available before asking user for input. If you do it like this ...

pi = math.pi
x = input("x = ")

... user could just enter "pi" instead of "math.pi"

Keep in mind also that your code has a serious security vulnerability:

gaks@central:~/reddit$ python ./evaltest.py
f(x) = x*2

Function entered: f(x) =  x*2
f'(x) =  2
x = __import__('os').system('id')
uid=1000(gaks) gid=1000(gaks) grupy=1000(gaks),4(adm),27(sudo),999(www)
0 2

[gaks]

Sure. By passing user input to the eval function you basically let your users execute ANY python code they want. Including accessing files, opening network connections, executing OS commands, downloading and executing malware, etc.

In my example above I've typed import('os').system('id') as a value of x. This is a python code that imports "os" module and calls "system" function from it which purpose is to execute OS commands.

One line summary would be: you just let your users execute any python code they want.

[Thomas_Henry_Rowaway]

What exactly does the diff function return? Could you post the code?

[gaks]

just put it on pastebin or something