From a755d013b4164b78f51170dd78e30dd7594077fb Mon Sep 17 00:00:00 2001 From: tomaioo Date: Mon, 20 Jul 2026 17:17:14 -0700 Subject: [PATCH] fix(security): use of `eval()` on file contents The `doit()` function in `perf/strip_cookbook_data.py` uses `eval(f.read())` to parse the contents of a file. If the file is untrusted or compromised, this could lead to arbitrary code execution. Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com> --- perf/strip_cookbook_data.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/perf/strip_cookbook_data.py b/perf/strip_cookbook_data.py index 94ba3048..6fff60aa 100644 --- a/perf/strip_cookbook_data.py +++ b/perf/strip_cookbook_data.py @@ -1,10 +1,11 @@ from os.path import * from pprint import pformat +import ast def doit(): recipes_path = expanduser("recipes.pprint") with open(recipes_path) as f: - recipe_dicts = eval(f.read()) + recipe_dicts = ast.literal_eval(f.read()) for r in recipe_dicts: for key in r.keys(): if key not in ('desc', 'comments'):