Module safemath

source code

Safe math context for evaluating expressions.

The following are defined:

context - dictionary of math functions suitable for use as global in eval
seval(expr) - expression evaluator
sexec(expr) - code evaluator
show() - display the symbols available in contexgt

The math symbols (functions, pi, e, inf, nan) are pulled from numpy and scipy so they will work equally well with scalars and vectors, real and complex.

The restricted environment does not allow any use of the underscore character. This suppresses most python introspection exploits. Of course, it also means that user code cannot define new classes or many of the other things a plugin environment may want to support.

Note: DoS attacks are pretty much impossible to stop if you give access to the interpreter. E.g., 'a'*2**64 will exceed memory, as will array([1,2]*2**64). Running the service in a separate process with resource limits can mitigate the problem, as well as protect against accidental infinite loops. If this process is running in a chroot jail or on a virtual machine, then eval/exec can be used directly.