Metadata

ID: python-security/no-compile

Language: Python

Severity: Error

Category: Security

CWE: 94

Description

compile() is insecure, and passing in unsanitized data could create a vulnerability, as reported by the official Python documentation. Generated code should be controlled as mentioned in CWE-94.

Learn More

• CWE-94 - Improper Control of Generation of Code

Non-Compliant Code Examples

x = compile('print(55)', 'test', 'eval')
exec(x)

Compliant Code Examples

print(55)