Metadata

ID: python-security/no-eval

Language: Python

Severity: Notice

Category: Security

CWE: 94

Description

eval() is insecure, and passing in unsanitized data could create a vulnerability, as reported by the official Python documentation. Generated code should be controlled as mentioned by CWE-94.

Learn More

• CWE-94 - Improper Control of Generation of Code

Non-Compliant Code Examples

print("bla")
eval('[1, 2, 3]') # eval() can be unsafe

Compliant Code Examples

import foo
foo.eval('[1, 2, 3]')

from ast import literal_eval
print("bla")
literal_eval('[1, 2, 3]')

Seamless integrations. Try Datadog Code Analysis

Datadog Code Analysis