The exec() function implies serious security risks, as you’ll learn soon. However, with great power comes great responsibility. To run the code, your programs will use exec(). To generate this new code, your programs will use information available at runtime only. In programming, a function like exec() is an incredibly powerful tool because it allows you to write programs that generate and execute new code dynamically. This is particularly true if you’re using untrusted input sources, like a user’s direct input, in building your code.
That’s one reason why exec() implies serious security risks. In this situation, you can rarely be certain of what your strings will contain. Once you’ve built the target code as strings, then you can use exec() to execute them as you would execute any Python code. You can also use the user’s input or any other input source to construct these strings. You can build these strings from parts that you obtain at different moments in your program’s execution. For example, you can write a program that generates strings containing valid Python code. You’ll commonly use exec() when you need to dynamically run code that comes as a string. Now that you’ve seen the main use case of exec(), what do you think those security risks might be? You’ll find the answer later in this tutorial.
Note: You’ve learned that using exec() can imply security risks. To get an initial feeling of how exec() works, you can create a rudimentary Python interpreter with two lines of code: This behavior notably differs from eval(), which returns the result of the evaluated expression. The exec() function’s return value is None, probably because not every piece of code has a final, unique, and concrete result. The globals and locals arguments allow you to provide dictionaries representing the global and local namespaces in which exec() will run the target code. If code holds a compiled code object, then it’s executed directly, making the process a bit more efficient. If code is a string, then it’s parsed as a suite of Python statements, which is then internally compiled into bytecode, and finally executed, unless a syntax error occurs during the parsing or compilation step. This intermediate translation is also referred to as compiled code and is what Python’s virtual machine executes. However, when you run some Python code, the interpreter translates it into bytecode, which is an internal representation of a Python program in the CPython implementation. Note: Python is an interpreted language instead of a compiled one.
0 kommentar(er)
