StackGuardian / tirith

StackGuardian Policy Framework
Apache License 2.0
125 stars 41 forks source link

Replace Tirith final_expression parser from eval() to a safer approach #172

Open refeed opened 2 months ago

refeed commented 2 months ago

Currently, the Tirith's final_expression expression is parsed by using Python's eval() function. Though we already have the eval() usage made as safe as possible, we still need to replace it with a safer approach like using a library.

An inspiration is to use: https://github.com/pyparsing/pyparsing/blob/master/examples/simpleBool.py

refeed commented 2 months ago

Or at least, replace eval() with https://docs.python.org/3/library/ast.html#ast.literal_eval

for the first iteration