Evaluator crash on complex assignment target in list comprehension about simpleeval HOT 3 OPEN

also this trick can be used to construct a list that contains itself:

>>> [x for x in ([None],) for x[0] in (x,)]
[[[...]]]

repr() is smart enough to handle the infinite-ness, but it can probably still be used to crash something:

>>> [x for x in ([None],) for x[0] in (x,)] == [x for x in ([None],) for x[0] in (x,)]
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
RecursionError: maximum recursion depth exceeded in comparison

from simpleeval.

That's... fun - definitely something to handle better than that!

I'm not tooooo worried about it, it's a bug, in that it throws a non-SimpleEval exception, but I don't believe there are any security implications.

Although, it would be good to add to the documentation that users should probably wrap any public facing usage of SimpleEval in a try:catch and log errors themselves...?

from simpleeval.

Hah, wow, that's an old one! I haven't done Python in a couple years so thanks for the reminder, this was a fun hack. I'm not sure if exploitability is a big worry here... i guess this circularity construction could maaaaaaybe be used as a DoS vector somehow. But i don't currently have ideas for how that'd work.

from simpleeval.