Closed moltenform closed 2 months ago
I prefer to get rid of calls to eval for security reasons,
eval
Especially in a setup.py file where one wouldn't expect code to run just by importing the file.
If someone malicious were to make a file in the right place they could get an arbitrary line of code to run.
Let's see if we can change the line
if line.startswith("__version__ ="): version = eval(line.split("=", 1)[1]) break
to
if line.startswith("__version__ ="): version = line.split("=", 1) version = version.replace('"', '').replace("'", '') version = version.strip() break
No reason why we can't, would you like to submit a PR?
Thanks!
Thank you!
I prefer to get rid of calls to
eval
for security reasons,Especially in a setup.py file where one wouldn't expect code to run just by importing the file.
If someone malicious were to make a file in the right place they could get an arbitrary line of code to run.
Let's see if we can change the line
to