Is "safe_eval" really safe?
<p>I'm looking for a "safe" eval function, to implement spreadsheet-like calculations (using numpy/scipy).</p>

<p>The functionality to do this (the <a href="http://docs.python.org/lib/module-rexec.html" rel="nofollow">rexec module</a>) has been removed from Python since 2.3 due to apparently unfixable security problems. There are several third-party hacks out there that purport to do this - the most thought-out solution that I have found is 
<a href="http://code.activestate.com/recipes/496746/" rel="nofollow">this Python Cookbok recipe</a>, "safe_eval". </p>

<p>Am I reasonably safe if I use this (or something similar), to protect from malicious code, or am I stuck with writing my own parser? Does anyone know of any better alternatives?</p>

<p>EDIT: I just discovered <a href="http://pypi.python.org/pypi/RestrictedPython" rel="nofollow">RestrictedPython</a>, which is part of Zope. Any opinions on this are  welcome.</p>

<p>Writing your own parser could be fun!  It might be a better option because people are expecting to use the familiar spreadsheet syntax (Excel, etc) and not Python when they're entering formulas.  I'm not familiar with safe_eval but I would imagine that anything like this certainly has the potential for exploitation.</p>
