Skip to content

Remove Use of exec function in electricpy.sim Module #42

@engineerjoe440

Description

@engineerjoe440

Request:

Remove use of the exec function in the electricpy.sim module:

        tempQstr += ")"
        if any(P_strgs[ii:i]):
            if verbose: print("Full P-Func Str:",tempPstr)
            exec(tempPstr)
        if any(Q_strgs[ii:i]):
            if verbose: print("Full Q-Func Str:",tempQstr)
            exec(tempQstr)
        ii = i # Increase Lower Index
    retset = (P_funcs,Q_funcs)

Reason:

Python's exec function is invariably a bit risky, and introduces the opportunity for malicious misuse of code. Though unlikely, it's always possible for some cleverly crafted strings be used to execute arbitrary code. I can't think of a particular way this could be exploited today, but just because I can't think of a way it might be done doesn't mean someone else won't, either.

References:

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions