1 comment

[ 3.3 ms ] story [ 12.7 ms ] thread
I liked David Goodger's attached comment, that the real problem is running eval / exec on untrusted input.

There's probably a corollary that no input is trusted.

But eh, I've had scratchpad scripts where I lazily used exec or eval on commands that were programmatically generated (not entered by user or from outside programs).