跟随伊格纳西奥·巴斯克斯（Ignacio Vazquez-brams）的想法：
import ast
import datetime
def parse_datetime_dict(astr,debug=False):
try: tree=ast.parse(astr)
except SyntaxError: raise ValueError(astr)
for node in ast.walk(tree):
if isinstance(node,(ast.Module,ast.Expr,ast.Dict,ast.Str,
ast.Attribute,ast.Num,ast.Name,ast.Load, ast.Tuple)): continue
if (isinstance(node,ast.Call)
and isinstance(node.func, ast.Attribute)
and node.func.attr == 'datetime'): continue
if debug:
attrs=[attr for attr in dir(node) if not attr.startswith('__')]
print(node)
for attrname in attrs:
print(' {k} ==> {v}'.format(k=attrname,v=getattr(node,attrname)))
raise ValueError(astr)
return eval(astr)
good_strings=["{'the_datetime': datetime.datetime(2010, 11, 21, 0, 56, 58)}"]
bad_strings=["__import__('os'); os.unlink",
"import os; os.unlink",
"import(os)", # SyntaxError
]
for astr in good_strings:
result=parse_datetime_dict(astr)
print('{s} ... [PASSED]'.format(s=astr))
for astr in bad_strings:
try:
result=parse_datetime_dict(astr)
except ValueError:
print('{s} ... [REJECTED]'.format(s=astr))
else:
sys.exit('ERROR: Failed to catch {s!r}'.format(s=astr))
产量
{'the_datetime': datetime.datetime(2010, 11, 21, 0, 56, 58)} ... [PASSED]
__import__('os'); os.unlink ... [REJECTED]
import os; os.unlink ... [REJECTED]
import(os) ... [REJECTED]
602392714
清零编程群