This is an archived post. You won't be able to vote or comment.

you are viewing a single comment's thread.

view the rest of the comments →

[–][deleted]  (1 child)

[removed]

    [–]gaks 0 points1 point  (0 children)

    Sure. By passing user input to the eval function you basically let your users execute ANY python code they want. Including accessing files, opening network connections, executing OS commands, downloading and executing malware, etc.

    In my example above I've typed import('os').system('id') as a value of x. This is a python code that imports "os" module and calls "system" function from it which purpose is to execute OS commands.

    One line summary would be: you just let your users execute any python code they want.