Online Tutorials & Training Materials | STechies.com
Register Login

What Does Python eval() Function Do?

20 Nov 2019 1:01 pm || 0

What is eval() in Python?

It is a built-in function. In layman language, the eval() method runs the python code (which is passed as an argument) within the program.

OR

The eval() method parses the expression passed to it and runs python expression(code) within the program.

Syntax

eval(expression, globals, locals)

Parameters

  • expression (Required): String as passed and evaluated as Python code
  • globals (Optional):  a dictionary containing global parameters
  • locals (Optional): a dictionary containing local parameters
  • Return: Returns the result of the evaluated expression

Example:

# Simple program to explain eval () method

x = 12
y = 20

print(eval('x+y'))

eval() Function with User Input

The best way to use eval() function is executing user input while doing dynamic execution of statements.

Here is a complex example where we have asked the user to enter the function to execute.

Example:

# eval() with user input
from math import *

func = input("Enter Function to Evaluate:\n")
try:
    print(eval(func))
except Exception as ex:
    print(ex)

Output:

Enter Math Function to Evaluate:
pow(2,3)
8.0

Vulnerabilities With eval() Function

As we know eval() function is used to execute in-built Python function with the user input. 

Suppose we have os module imported and the user enters os.system('rm -rf /') command to execute.

Once the command gets executed, it will start to delete system files and corrupt our environment.

That’s why you must check the user entered data first, before using the eval() function to execute user input code. This can be very useful whenever you use globals and locals parameters. 

eval() Function with Global and Local Directory

With the help of global and local directory, we can restrict the user to execute a limited set to commands.

Check available function and variables in the local and global scope.

Example:

# Python program to check local and global scope

# Import math library 
from math import *;

def power(n,m):
    return pow(n,m)

print(globals()) #This will return the current global symbol table.
print(locals())  #This will return the current local symbol table.
print(dir())  #List of the names in current local scope 

Output:

{'atan2': <built-in function atan2>, 'gamma': <built-in function gamma>, 'fabs': <built-in function fabs>, '__loader__': <_frozen_importlib.SourceFileLoader object at 0x7fa14f913e10>, 'log': <built-in function log>, 'log1p': <built-in function log1p>, 'sin': <built-in function sin>, 'copysign': <built-in function copysign>, '__name__': '__main__', 'factorial': <built-in function factorial>, 'log10': <built-in function log10>, 'lgamma': <built-in function lgamma>, 'degrees': <built-in function degrees>, 'sinh': <built-in function sinh>, 'cosh': <built-in function cosh>, 'acosh': <built-in function acosh>, 'ldexp': <built-in function ldexp>, '__file__': 'main.py', 'hypot': <built-in function hypot>, 'pi': 3.141592653589793, '__doc__': None, 'e': 2.718281828459045, 'pow': <built-in function pow>, 'frexp': <built-in function frexp>, 'fmod': <built-in function fmod>, 'trunc': <built-in function trunc>, 'asinh': <built-in function asinh>, 'erfc': <built-in function erfc>, 'acos': <built-in function acos>, 'expm1': <built-in function expm1>, '__spec__': None, 'erf': <built-in function erf>, 'radians': <built-in function radians>, 'isinf': <built-in function isinf>, 'ceil': <built-in function ceil>, '__builtins__': <module 'builtins' (built-in)>, 'fsum': <built-in function fsum>, 'tanh': <built-in function tanh>, 'log2': <built-in function log2>, 'tan': <built-in function tan>, 'cos': <built-in function cos>, 'power': <function power at 0x7fa14f962bf8>, 'atanh': <built-in function atanh>, 'asin': <built-in function asin>, 'floor': <built-in function floor>, 'modf': <built-in function modf>, 'atan': <built-in function atan>, 'isnan': <built-in function isnan>, 'sqrt': <built-in function sqrt>, '__package__': None, 'isfinite': <built-in function isfinite>, '__cached__': None, 'exp': <built-in function exp>}
{'atan2': <built-in function atan2>, 'gamma': <built-in function gamma>, 'fabs': <built-in function fabs>, '__loader__': <_frozen_importlib.SourceFileLoader object at 0x7fa14f913e10>, 'log': <built-in function log>, 'log1p': <built-in function log1p>, 'sin': <built-in function sin>, 'copysign': <built-in function copysign>, '__name__': '__main__', 'factorial': <built-in function factorial>, 'log10': <built-in function log10>, 'lgamma': <built-in function lgamma>, 'degrees': <built-in function degrees>, 'sinh': <built-in function sinh>, 'cosh': <built-in function cosh>, 'acosh': <built-in function acosh>, 'ldexp': <built-in function ldexp>, '__file__': 'main.py', 'hypot': <built-in function hypot>, 'pi': 3.141592653589793, '__doc__': None, 'e': 2.718281828459045, 'pow': <built-in function pow>, 'frexp': <built-in function frexp>, 'fmod': <built-in function fmod>, 'trunc': <built-in function trunc>, 'asinh': <built-in function asinh>, 'erfc': <built-in function erfc>, 'acos': <built-in function acos>, 'expm1': <built-in function expm1>, '__spec__': None, 'erf': <built-in function erf>, 'radians': <built-in function radians>, 'isinf': <built-in function isinf>, 'ceil': <built-in function ceil>, '__builtins__': <module 'builtins' (built-in)>, 'fsum': <built-in function fsum>, 'tanh': <built-in function tanh>, 'log2': <built-in function log2>, 'tan': <built-in function tan>, 'cos': <built-in function cos>, 'power': <function power at 0x7fa14f962bf8>, 'atanh': <built-in function atanh>, 'asin': <built-in function asin>, 'floor': <built-in function floor>, 'modf': <built-in function modf>, 'atan': <built-in function atan>, 'isnan': <built-in function isnan>, 'sqrt': <built-in function sqrt>, '__package__': None, 'isfinite': <built-in function isfinite>, '__cached__': None, 'exp': <built-in function exp>}
['__builtins__', '__cached__', '__doc__', '__file__', '__loader__', '__name__', '__package__', '__spec__', 'acos', 'acosh', 'asin', 'asinh', 'atan', 'atan2', 'atanh', 'ceil', 'copysign', 'cos', 'cosh', 'degrees', 'e', 'erf', 'erfc', 'exp', 'expm1', 'fabs', 'factorial', 'floor', 'fmod', 'frexp', 'fsum', 'gamma', 'hypot', 'isfinite', 'isinf', 'isnan', 'ldexp', 'lgamma', 'log', 'log10', 'log1p', 'log2', 'modf', 'pi', 'pow', 'power', 'radians', 'sin', 'sinh', 'sqrt', 'tan', 'tanh', 'trunc']

In the above example, you can see that eval() function have access to lots of function to access and all these functions are build-in and as we have imported math library so the functions are from the math library.

eval() Function with Empty Directory

Code: 

print(eval('dir()',{})) 

Output:

['__builtins__']

You can see if we run eval() function with empty directory still it has the access to builtin methods. 

So to restrict the user to use the limited function, you need to specify these function as global.

Example:

# Python eval() function with global

# Import math library
from math import *;

# Take input from user 
userInput = input("Enter Math Function to Evaluate.\nAllowed Functions are \nsamllIntegral(n)\nlargestIntegral(n)\nabs(n)\nfact(n)\n");

try:
    print(eval(userInput,{'samllIntegral':ceil,'largestIntegral':floor,'abs':fabs,'fact':factorial}))
except Exception as excep:
    print(excep)

print('Operation Done')

Output:

Enter Math Function to Evaluate. 
Allowed Functions are 
samllIntegral(n) 
largestIntegral(n) 
abs(n) 
fact(n) 
samllIntegral(2.3) 
3 
Operation Done

In the above example, we have restricted the user to run only limited programs like “ceil, floor, fabs” if the user enters in any other function then program will raise an exception. 

Example with Local Scope

# Python eval() function with local

# Import math library

userInput1 = int(input("Enter first value to Evaluate : "))
userInput2 = int(input("Enter first value to Evaluate : "))

try:
    print(eval('input_1 + input_2',{'__builtins__':None},{'input_1':userInput1,'input_2':userInput2}))
except Exception as excep:
    print(excep)

print('Operation Done')

Output:

Enter first value to Evaluate : 21
Enter first value to Evaluate : 21
42
Operation Done