search

GurpreetKang / BitwardenDecrypt

Decrypts an encrypted Bitwarden data.json file.
GNU General Public License v3.0
245 stars 30 forks source link

Reason for `ast.literal_eval`? #2

Closed GurpreetKang closed 3 years ago

GurpreetKang commented 3 years ago

Issue #1 was originally created by @irgeek, but was accidentally deleted by me. :slightly_frowning_face:

https://github.com/GurpreetKang/BitwardenDecrypt/blob/4751d6053f4ecc6d218793ebb16646e856f77796/BitwardenDecrypt.py#L279

I noticed while perusing the code that you seem to be turning parts of the already-decoded JSON into string and evaluating them as Python with the ast.literal_eval method. What's the reason for this? It's common practice to avoid eval whenever possible, and this specific usage appears to do nothing more than inefficiently copy a data structure.

GurpreetKang commented 3 years ago

Hi @irgeek,

Honestly, I don't remember the reason. I originally wrote this very late one night and I was getting an error and using ast.literal_eval fixed it so I moved on to other issues that were causing decryption to fail. I have since re-wrote most of the script but I never revisited this. I don't think ast.literal_eval has the same concerns as eval though so I don't think it's a concern.

I should change this to: groupData = json.loads(json.dumps(datafile[a]))

I'll make the change on my next commit. Thanks for catching this. :slightly_smiling_face:

GurpreetKang commented 3 years ago

Fixed in 4751d6053f4ecc6d218793ebb16646e856f77796.