Python eval 作用和风险 （string 转为dict list tuple）建议用“ast.literal_eval”

?

1 2 3 4 5

a = "[[1,2], [3,4], [5,6], [7,8], [9,0]]"   b = eval(a)   print b

[[1, 2], [3, 4], [5, 6], [7, 8], [9, 0]]
[Finished in 0.2s]

?

1 2 3 4

a = "{1: 'a', 2: 'b'}"  b = eval(a) print b print type(b)

{1: 'a', 2: 'b'}
<type 'dict'>
[Finished in 0.2s]

-----风险-------

eval强大的背后，是巨大的安全隐患！！！ 比如说,用户恶意输入下面的字符串

open(r'D://filename.txt', 'r').read()

__import__('os').system('dir')

__import__('os').system('rm -rf /etc/*')

?

1 2 3 4

a = "__import__('os').system('dir')"  b = eval(a) print b print type(b)

Volume in drive D has no label.
Volume Serial Number is 66B4-8B5C

Directory of D:\AlamTW\study\python

13/06/2017 PM 03:23 <DIR> .
13/06/2017 PM 03:23 <DIR> ..
14/03/2017 PM 05:20 1,388 20170314-1.py
01/04/2017 PM 03:20 2,180 20170401.py
16/05/2017 PM 02:47 386 20170516unittest.py
21/04/2017 AM 10:57 147 testDemo.yaml
21/04/2017 AM 11:18 525 yaml_python.py
14/03/2017 PM 01:44 <DIR> __pycache__
38 File(s) 27,575 bytes
8 Dir(s) 390,064,582,656 bytes free
0
<type 'int'>
[Finished in 0.3s]

------所以用ast.literal_eval代替----

?

1 2 3 4 5 6 7

import ast   a = "open('test.py').read()"  # b = eval(a) b = ast.literal_eval(a) print b print type(b)

ValueError: malformed string