converting arguments or input numbers

[Skaperen]

i've been doing things like this to convert arguments or input numbers:

   number = int(sys.argv[1])

now i have found a different way that is more fun though it needs more coding:

    try:
        number = eval(sys.argv[1])
    except:
        print('oops!')
        error_count += 1

if you want the traceback info, don't use the try/except. then you don't have to calculate formulas to enter their values (though you might have to use quotes around many formulas for most command shells).

[ichabod801]

Hang on a minute guys. Let me put the pop corn in the microwave.

[snippsat]

λ python arg_test.py "__import__('os').remove('important_file.dat')"
None

λ python arg_test.py "__import__('os').remove('important_file.dat')"
oops!

When important_file is gone then get a oops.

[Gribouillis]

Besides the questionable use of eval, your code would improve by using a library to parse command line arguments, typically argparse of one of its wrappers argh or click or others.

[Skaperen]

you can do that faster as a shell command. i won't be doing that on code that needs to run securely. it will be in code that runs with the credentials of who runs it. if you run it and do that, you'll only be doing it to yourself.

---

Besides the questionable use of eval, your code would improve by using a library to parse command line arguments, typically argparse of one of its wrappers argh or click or others.

some of those libraries may be usable for some of my programs. most of my commands have unusual and/or non-standard command syntax. i have seen nothing that am able to use on eve half of my commands. my next program will have a syntax that uses both - and + and can even mix both sets of option within the same argument. and these options have specific influence on how the file names are tested as it goes. and, of course, error messages include argument context for user.

what are your questions about my use of eval()? am i calling it with credentials different than who types in that option? no!

[buran]

in which world your snippet with eval is better than the other one?

or if you want it with try/except

try:
    number = int(sys.argv[1])
except:
    print('oops!')
    error_count += 1

I also fully agree with Gribouillis that you will be better using package like click or similar...

[DeaD_EyE]

Your example is insecure:

python test.py 'os.remove("important_dir/test.bin")'

The probability that the os module is already imported, is very high.

If you want to give your hackers more features like executing statements, use the built-in exec function.
Then the hacker is able to do everything. Evaluating/Executing user input is unsafe and it's well known since WEB2.0.
This is the first lesson you learn. Never trust input, where you don't have control over it. It does not
matter if the input comes from a machine or a human. It's not under your control, then it's unsafe.

[Gribouillis]

What about os.remove(__file__) or shutil.rmtree(os.path.expanduser("~")) ?

[Skaperen]

@buran i just wrote a script that takes Unicode code points in various forms and converts them to a UTF-8 octet stream output (in hex) i can give it numbers on the command or in the input. i could add numbers. or i can give it an expression like range(0x400,0x440).

_