search

efabless / cace

Circuit Automatic Characterization Engine
https://cace.readthedocs.io/
Apache License 2.0
36 stars 6 forks source link

Changed python "eval()" to "ast.literal_eval()" for security reasons. #18

Closed RTimothyEdwards closed 4 months ago

RTimothyEdwards commented 4 months ago

Changed python "eval()" to "ast.literal_eval()" in all occurrences where it is used to evaluate expressions used in testbench schematics. The intention was for eval() to resolve simple mathematical expressions, not to execute any general-purpose python code, and the use of the "safe" evaluation will prevent any accidental or malicious use of python code embedded in CACE testbenches.

RTimothyEdwards commented 4 months ago

Ugh, it turns out you can't believe everything you read on the internet! Who knew? A lot of information about "ast.literal_eval()" may predate python3.7 when it was no longer allowed to evaluate arithmetic expressions (didn't investigate the reason why). Unfortunately, that's exactly what CACE needs to do here. There is a StackOverflow solution (because of course there is), that I have tested and appears to work exactly the way CACE needs, so I will revert this change and reimplement it accordingly.