我有一个网站，用户输入数学公式（表达式），然后根据网站提供的数据（常数）评估这些公式。所需的数学运算包括符号，算术运算，min()，max()和其他一些基本功能。示例等式可以是：
max(a * b + 100, a / b - 200)
可以简单eval()使用Python，但我们都知道这会导致网站泄露。进行数学方程式评估的安全方法是什么？
Python的数学方程解析和评估引擎
如果选择使用Python本身来评估表达式，那么任何Python沙箱都会限制Python，因此只有用户供应商运营商和功能可用。完全成熟的Python，如定义函数，应该完全禁用。子流程没问题（参见PyPy sandbox）。特别是，应该关闭用于利用内存和CPU使用的循环和其他漏洞。
任何其他方法，例如通过使用命令行二进制（bc）？
答案 0 :(得分：8)
免责声明：我是其他答案中代码中提到的Alexer。老实说，我只是半开玩笑地建议使用字节码解析方法，因为我碰巧有99％的代码存在于一个不相关的项目中，因此可以在几分钟内将POC组合在一起。也就是说，它本身应该没有任何问题;只是它是这项任务所需的更复杂的机器。实际上，你应该能够通过反汇编代码[检查操作码对白名单]，检查常量和名称是否有效，然后用普通的，邪恶的eval执行它。你应该失去在整个执行过程中插入偏执的额外检查的能力。 （另一个免责声明：我仍然觉得用eval做得不够舒服）
无论如何，我有一个无聊的时刻，所以我写了一些代码以聪明的方式做到这一点;使用AST而不是字节码。这只是compile()的额外标志。 （或者只是ast.parse()，因为无论如何你都需要模块中的类型）
import ast
import operator
_operations = {
ast.Add: operator.add,
ast.Sub: operator.sub,
ast.Mult: operator.mul,
ast.Div: operator.div,
ast.Pow: operator.pow,
}
def _safe_eval(node, variables, functions):
if isinstance(node, ast.Num):
return node.n
elif isinstance(node, ast.Name):
return variables[node.id] # KeyError -> Unsafe variable
elif isinstance(node, ast.BinOp):
op = _operations[node.op.__class__] # KeyError -> Unsafe operation
left = _safe_eval(node.left, variables, functions)
right = _safe_eval(node.right, variables, functions)
if isinstance(node.op, ast.Pow):
assert right < 100
return op(left, right)
elif isinstance(node, ast.Call):
assert not node.keywords and not node.starargs and not node.kwargs
assert isinstance(node.func, ast.Name), 'Unsafe function derivation'
func = functions[node.func.id] # KeyError -> Unsafe function
args = [_safe_eval(arg, variables, functions) for arg in node.args]
return func(*args)
assert False, 'Unsafe operation'
def safe_eval(expr, variables={}, functions={}):
node = ast.parse(expr, '<string>', 'eval').body
return _safe_eval(node, variables, functions)
if __name__ == '__main__':
import math
print safe_eval('sin(a*pi/b)', dict(a=1, b=2, pi=math.pi), dict(sin=math.sin))
对于字节码版本，同样适用于此;如果你检查白名单的操作并检查名称和值是否有效，你应该能够在AST上调用eval。 （但是，我仍然不会这样做。因为偏执狂。当关注eval时，偏执狂是好的）
答案 1 :(得分：6)
在没有第三方软件包的情况下，在Python中执行此操作相对容易。
使用compile()准备单行Python表达式作为eval()的字节码
不通过eval()运行字节码，而是在自定义操作码循环中运行它，并且只实现您真正需要的操作码。例如。没有内置函数，没有属性访问权限，因此沙箱无法转义。
然而，有一些问题，比如准备CPU耗尽和内存耗尽，这些问题并非特定于此方法，也是其他方法的问题。
Here is a full blog post about the topic。 Here is a related gist。以下是缩短的示例代码。
""""
The orignal author: Alexer / #python.fi
"""
import opcode
import dis
import sys
import multiprocessing
import time
# Python 3 required
assert sys.version_info[0] == 3, "No country for old snakes"
class UnknownSymbol(Exception):
""" There was a function or constant in the expression we don't support. """
class BadValue(Exception):
""" The user tried to input dangerously big value. """
MAX_ALLOWED_VALUE = 2**63
class BadCompilingInput(Exception):
""" The user tried to input something which might cause compiler to slow down. """
def disassemble(co):
""" Loop through Python bytecode and match instructions with our internal opcodes.
:param co: Python code object
"""
code = co.co_code
n = len(code)
i = 0
extended_arg = 0
result = []
while i < n:
op = code[i]
curi = i
i = i+1
if op >= dis.HAVE_ARGUMENT:
# Python 2
# oparg = ord(code[i]) + ord(code[i+1])*256 + extended_arg
oparg = code[i] + code[i+1] * 256 + extended_arg
extended_arg = 0
i = i+2
if op == dis.EXTENDED_ARG:
# Python 2
#extended_arg = oparg*65536L
extended_arg = oparg*65536
else:
oparg = None
# print(opcode.opname[op])
opv = globals()[opcode.opname[op].replace('+', '_')](co, curi, i, op, oparg)
result.append(opv)
return result
# For the opcodes see dis.py
# (Copy-paste)
# https://docs.python.org/2/library/dis.html
class Opcode:
""" Base class for out internal opcodes. """
args = 0
pops = 0
pushes = 0
def __init__(self, co, i, nexti, op, oparg):
self.co = co
self.i = i
self.nexti = nexti
self.op = op
self.oparg = oparg
def get_pops(self):
return self.pops
def get_pushes(self):
return self.pushes
def touch_value(self, stack, frame):
assert self.pushes == 0
for i in range(self.pops):
stack.pop()
class OpcodeArg(Opcode):
args = 1
class OpcodeConst(OpcodeArg):
def get_arg(self):
return self.co.co_consts[self.oparg]
class OpcodeName(OpcodeArg):
def get_arg(self):
return self.co.co_names[self.oparg]
class POP_TOP(Opcode):
"""Removes the top-of-stack (TOS) item."""
pops = 1
def touch_value(self, stack, frame):
stack.pop()
class DUP_TOP(Opcode):
"""Duplicates the reference on top of the stack."""
# XXX: +-1
pops = 1
pushes = 2
def touch_value(self, stack, frame):
stack[-1:] = 2 * stack[-1:]
class ROT_TWO(Opcode):
"""Swaps the two top-most stack items."""
pops = 2
pushes = 2
def touch_value(self, stack, frame):
stack[-2:] = stack[-2:][::-1]
class ROT_THREE(Opcode):
"""Lifts second and third stack item one position up, moves top down to position three."""
pops = 3
pushes = 3
direct = True
def touch_value(self, stack, frame):
v3, v2, v1 = stack[-3:]
stack[-3:] = [v1, v3, v2]
class ROT_FOUR(Opcode):
"""Lifts second, third and forth stack item one position up, moves top down to position four."""
pops = 4
pushes = 4
direct = True
def touch_value(self, stack, frame):
v4, v3, v2, v1 = stack[-3:]
stack[-3:] = [v1, v4, v3, v2]
class UNARY(Opcode):
"""Unary Operations take the top of the stack, apply the operation, and push the result back on the stack."""
pops = 1
pushes = 1
class UNARY_POSITIVE(UNARY):
"""Implements TOS = +TOS."""
def touch_value(self, stack, frame):
stack[-1] = +stack[-1]
class UNARY_NEGATIVE(UNARY):
"""Implements TOS = -TOS."""
def touch_value(self, stack, frame):
stack[-1] = -stack[-1]
class BINARY(Opcode):
"""Binary operations remove the top of the stack (TOS) and the second top-most stack item (TOS1) from the stack. They perform the operation, and put the result back on the stack."""
pops = 2
pushes = 1
class BINARY_POWER(BINARY):
"""Implements TOS = TOS1 ** TOS."""
def touch_value(self, stack, frame):
TOS1, TOS = stack[-2:]
print(TOS1, TOS)
if abs(TOS1) > BadValue.MAX_ALLOWED_VALUE or abs(TOS) > BadValue.MAX_ALLOWED_VALUE:
raise BadValue("The value for exponent was too big")
stack[-2:] = [TOS1 ** TOS]
class BINARY_MULTIPLY(BINARY):
"""Implements TOS = TOS1 * TOS."""
def touch_value(self, stack, frame):
TOS1, TOS = stack[-2:]
stack[-2:] = [TOS1 * TOS]
class BINARY_DIVIDE(BINARY):
"""Implements TOS = TOS1 / TOS when from __future__ import division is not in effect."""
def touch_value(self, stack, frame):
TOS1, TOS = stack[-2:]
stack[-2:] = [TOS1 / TOS]
class BINARY_MODULO(BINARY):
"""Implements TOS = TOS1 % TOS."""
def touch_value(self, stack, frame):
TOS1, TOS = stack[-2:]
stack[-2:] = [TOS1 % TOS]
class BINARY_ADD(BINARY):
"""Implements TOS = TOS1 + TOS."""
def touch_value(self, stack, frame):
TOS1, TOS = stack[-2:]
stack[-2:] = [TOS1 + TOS]
class BINARY_SUBTRACT(BINARY):
"""Implements TOS = TOS1 - TOS."""
def touch_value(self, stack, frame):
TOS1, TOS = stack[-2:]
stack[-2:] = [TOS1 - TOS]
class BINARY_FLOOR_DIVIDE(BINARY):
"""Implements TOS = TOS1 // TOS."""
def touch_value(self, stack, frame):
TOS1, TOS = stack[-2:]
stack[-2:] = [TOS1 // TOS]
class BINARY_TRUE_DIVIDE(BINARY):
"""Implements TOS = TOS1 / TOS when from __future__ import division is in effect."""
def touch_value(self, stack, frame):
TOS1, TOS = stack[-2:]
stack[-2:] = [TOS1 / TOS]
class BINARY_LSHIFT(BINARY):
"""Implements TOS = TOS1 << TOS."""
def touch_value(self, stack, frame):
TOS1, TOS = stack[-2:]
stack[-2:] = [TOS1 << TOS]
class BINARY_RSHIFT(BINARY):
"""Implements TOS = TOS1 >> TOS."""
def touch_value(self, stack, frame):
TOS1, TOS = stack[-2:]
stack[-2:] = [TOS1 >> TOS]
class BINARY_AND(BINARY):
"""Implements TOS = TOS1 & TOS."""
def touch_value(self, stack, frame):
TOS1, TOS = stack[-2:]
stack[-2:] = [TOS1 & TOS]
class BINARY_XOR(BINARY):
"""Implements TOS = TOS1 ^ TOS."""
def touch_value(self, stack, frame):
TOS1, TOS = stack[-2:]
stack[-2:] = [TOS1 ^ TOS]
class BINARY_OR(BINARY):
"""Implements TOS = TOS1 | TOS."""
def touch_value(self, stack, frame):
TOS1, TOS = stack[-2:]
stack[-2:] = [TOS1 | TOS]
class RETURN_VALUE(Opcode):
"""Returns with TOS to the caller of the function."""
pops = 1
final = True
def touch_value(self, stack, frame):
value = stack.pop()
return value
class LOAD_CONST(OpcodeConst):
"""Pushes co_consts[consti] onto the stack.""" # consti
pushes = 1
def touch_value(self, stack, frame):
# XXX moo: Validate type
value = self.get_arg()
assert isinstance(value, (int, float))
stack.append(value)
class LOAD_NAME(OpcodeName):
"""Pushes the value associated with co_names[namei] onto the stack.""" # namei
pushes = 1
def touch_value(self, stack, frame):
# XXX moo: Get name from dict of valid variables/functions
name = self.get_arg()
if name not in frame:
raise UnknownSymbol("Does not know symbol {}".format(name))
stack.append(frame[name])
class CALL_FUNCTION(OpcodeArg):
"""Calls a function. The low byte of argc indicates the number of positional parameters, the high byte the number of keyword parameters. On the stack, the opcode finds the keyword parameters first. For each keyword argument, the value is on top of the key. Below the keyword parameters, the positional parameters are on the stack, with the right-most parameter on top. Below the parameters, the function object to call is on the stack. Pops all function arguments, and the function itself off the stack, and pushes the return value.""" # argc
pops = None
pushes = 1
def get_pops(self):
args = self.oparg & 0xff
kwargs = (self.oparg >> 8) & 0xff
return 1 + args + 2 * kwargs
def touch_value(self, stack, frame):
argc = self.oparg & 0xff
kwargc = (self.oparg >> 8) & 0xff
assert kwargc == 0
if argc > 0:
args = stack[-argc:]
stack[:] = stack[:-argc]
else:
args = []
func = stack.pop()
assert func in frame.values(), "Uh-oh somebody injected bad function. This does not happen."
result = func(*args)
stack.append(result)
def check_for_pow(expr):
""" Python evaluates power operator during the compile time if its on constants.
You can do CPU / memory burning attack with ``2**999999999999999999999**9999999999999``.
We mainly care about memory now, as we catch timeoutting in any case.
We just disable pow and do not care about it.
"""
if "**" in expr:
raise BadCompilingInput("Power operation is not allowed")
def _safe_eval(expr, functions_and_constants={}, check_compiling_input=True):
""" Evaluate a Pythonic math expression and return the output as a string.
The expr is limited to 1024 characters / 1024 operations
to prevent CPU burning or memory stealing.
:param functions_and_constants: Supplied "built-in" data for evaluation
"""
# Some safety checks
assert len(expr) < 1024
# Check for potential bad compiler input
if check_compiling_input:
check_for_pow(expr)
# Compile Python source code to Python code for eval()
code = compile(expr, '', 'eval')
# Dissect bytecode back to Python opcodes
ops = disassemble(code)
assert len(ops) < 1024
stack = []
for op in ops:
value = op.touch_value(stack, functions_and_constants)
return value