Metadata

ID: python-security/no-eval

Language: Python

Severity: Notice

Category: Security

Description

eval() is insecure, and uncontrolled data could then create a vulnerability, as reported by the official Python documentation. Generated code should be controlled as mentioned by CWE-94.

Learn More

• CWE-94 - Improper Control of Generation of Code
• Safe and Secure Python: do not use eval()

Non-Compliant Code Examples

print("bla")
eval('[1, 2, 3]') # eval() can be unsafe

Compliant Code Examples

import foo
foo.eval('[1, 2, 3]')

from ast import literal_eval
print("bla")
literal_eval('[1, 2, 3]')

Seamless integrations. Try Datadog Code Analysis

Datadog Code Analysis