I have a string "[u'foo']" (Yes, it includes the square brackets and the u''). I have to convert that to a list which looks like [u'foo'].
list("[u'foo']") won't work.
Any suggestions?
-
1Can you clarify? What's the list supposed to contain?Mike– Mike2010-09-01 22:46:42 +00:00Commented Sep 1, 2010 at 22:46
-
Where does the string come from? That's not a very useful format to have; if you're generating it, consider using a better format.habnabit– habnabit2010-09-01 23:16:37 +00:00Commented Sep 1, 2010 at 23:16
-
I get it from GAE bulkloader bulk_download. It's a list property in the datastore. It get's downloaded and ends up looking like that in my csv file. Any suggestions?Albert– Albert2010-09-02 00:15:36 +00:00Commented Sep 2, 2010 at 0:15
Add a comment
|
2 Answers
>>> import ast
>>> s = "[u'foo']"
>>> ast.literal_eval(s)
[u'foo']
Comments
eval("[u'foo']", {'__builtins__':[]}, {})
6 Comments
habnabit
You know that passing empty dicts for
locals and globals isn't enough to 'secure' eval, yes? This still gives an attacker basically full access to your system.
leoluk
POC:
eval('__import__("os").getcwd()', {}, {}), I edited my answerhabnabit
@leoluk, that doesn't 'prove' anything.
eval("[x for x in type(type(1)).__bases__[0].__subclasses__() if x.__name__ == 'file'][0]('/etc/passwd').readline()", {}, {}) gives me the first line of /etc/passwd on my system.
Albert
@Aaron, cool... By the way, if I can't use literal_eval(), what would you suggest as a 'secure' eval?
habnabit
@Albert, I would suggest modifying your desires so that you don't have to.
|