Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

flake8-bandit rules does not check eval in callback position #15522

Open
xvlady opened this issue Jan 16, 2025 · 3 comments · May be fixed by #15541
Open

flake8-bandit rules does not check eval in callback position #15522

xvlady opened this issue Jan 16, 2025 · 3 comments · May be fixed by #15541
Labels
bug Something isn't working rule Implementing or modifying a lint rule

Comments

@xvlady
Copy link

xvlady commented Jan 16, 2025

Demo code:

from pandas import DataFrame

def me_eval():
    eval('[]')
    df = DataFrame({'a': ['1', '[]', '[1,2,3]'], 'b': [4, 5, 6]})
    # print(df.to_dict())
    df['a'] = df['a'].apply(eval)
    # print(df.to_dict())
    map(eval, l)
    # print([i for i in r])


if __name__ == '__main__':
    me_eval()

Result:

{'a': {0: '1', 1: '[]', 2: '[1,2,3]'}, 'b': {0: 4, 1: 5, 2: 6}}
{'a': {0: 1, 1: [], 2: [1, 2, 3]}, 'b': {0: 4, 1: 5, 2: 6}}
[1, [], [1, 2, 3]]

Result check:

ruff check
demo_eval.py:5:5: S307 Use of possibly insecure function; consider using `ast.literal_eval`
  |
4 | def me_eval():
5 |     eval('[]')
  |     ^^^^^^^^^^ S307
6 |     df = DataFrame({'a': ['1', '[]', '[1,2,3]'], 'b': [4, 5, 6]})
7 |     # print(df.to_dict())
  |

This result check has problems: 8 and 10 lines with eval don't have message ruff
problem text:

 df['a'].apply(eval)
map(eval, ***)
@MichaReiser MichaReiser added bug Something isn't working rule Implementing or modifying a lint rule labels Jan 16, 2025
@MichaReiser
Copy link
Member

TLDR: S307 only finds literal eval call but not when eval is used in a callback position. We should probably change the rule to warn about all usages of eval

@dylwil3
Copy link
Collaborator

dylwil3 commented Jan 16, 2025

We should also change exec-builtin (S102) for the same reason.

@dhruvmanila dhruvmanila changed the title Don't checking eval S307 flake8-bandit rules does not check eval in callback position Jan 17, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working rule Implementing or modifying a lint rule
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants