Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use response.json() instead of eval() #18

Open
mgood opened this issue Sep 19, 2013 · 1 comment
Open

Use response.json() instead of eval() #18

mgood opened this issue Sep 19, 2013 · 1 comment

Comments

@mgood
Copy link

mgood commented Sep 19, 2013

Requests has a convenient way to parse JSON responses:

http://docs.python-requests.org/en/latest/user/quickstart/#json-response-content

Not only is this easy to use, but it prevents the major security issue of calling eval() on a response from a remote service.

@mgood
Copy link
Author

mgood commented Sep 19, 2013

Oh, it seems that you're using the Jenkins "Python" flavored API instead of JSON. I don't see the Jenkins docs mention explicitly what types might be encoded in the Python responses, but if it's equivalent to the JSON types (dict, list, etc) using JSON would be a safer alternative. Or you could possibly use this to safely parse Python's literal types without allowing code execution:
http://docs.python.org/2/library/ast.html#ast.literal_eval

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant