Q61: Why is eval() insecure and why should ast.literal_eval() be used instead?
eval(): Parses and executes arbitrary Python code strings, opening system vulnerabilities to command execution attacks.ast.literal_eval(): Safely evaluates strings containing strictly basic Python literals (strings, numbers, tuples, lists, dicts, booleans), rejecting code execution.
Key Takeaways
eval()executes arbitrary code (extreme security risk).ast.literal_eval()safely evaluates primitive literal data structures.
Knowledge Check
What happens if a string containing __import__('os').system('rm -rf /') is passed to ast.literal_eval()?