The ast module exposes Python's abstract syntax tree. ast.literal_eval is a safe evaluator for literals only. The builtins eval() and exec() execute arbitrary Python code — RCE sinks on user input. compile() produces code objects that reach exec().
.literal_eval().eval().exec().compile().eval()Sinkeval(expression, globals=None, locals=None) -> Any
Evaluates a Python expression. RCE sink when expression is user-controlled.
0.exec()Sinkexec(object, globals=None, locals=None) -> None
Executes Python code. RCE sink on user-controlled source.
0.compile()Sinkcompile(source, filename, mode, flags=0, dont_inherit=False, optimize=-1)
Compiles source to a code object. Reaches exec / eval. Sink on user-controlled source.
0.literal_eval()Sanitizerast.literal_eval(node_or_string) -> Any
Safely evaluates Python literals (str, int, list, dict, tuple, bool, None). Sanitizer replacement for eval().
return.parse()Neutralast.parse(source, filename='<unknown>', mode='exec', ...) -> Module
Parses source into an AST. Neutral on its own.
| FQN | Field | |
|---|---|---|
| ast | fqns[0] | |
| builtins | fqns[1] |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
from codepathfinder.go_rule import PyAst