Skip to content

Do not set eval() globals in ImageMath.unsafe_eval()#9576

Merged
hugovk merged 1 commit into
python-pillow:mainfrom
radarhere:eval
Jun 27, 2026
Merged

Do not set eval() globals in ImageMath.unsafe_eval()#9576
hugovk merged 1 commit into
python-pillow:mainfrom
radarhere:eval

Conversation

@radarhere

Copy link
Copy Markdown
Member

out = builtins.eval(expression, {"__builtins": {"abs": abs}}, args)

The use of {"__builtins": {"abs": abs}} rather than {"__builtins__": {"abs": abs}} looks like a typo from #5923

However, if I abandon it entirely and just use None, nothing breaks, so I suggest that as the cleanest code.

https://docs.python.org/3/library/functions.html#eval

Overriding __builtins__ can be used to restrict or change the available names, but this is not a security mechanism: the executed code can still access all builtins.

@radarhere radarhere changed the title Do not set eval() globals Do not set eval() globals in ImageMath.unsafe_eval() Apr 20, 2026
@hugovk hugovk merged commit 2836057 into python-pillow:main Jun 27, 2026
53 checks passed
@radarhere radarhere deleted the eval branch June 27, 2026 21:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants