From 4aa6325ae888147d629d6bcc81c9bfdc8642f6b2 Mon Sep 17 00:00:00 2001 From: Stan Triepels <1939656+GDay@users.noreply.github.com> Date: Fri, 14 Oct 2022 16:04:38 +0200 Subject: [PATCH] Replace use of eval() by ast.parse() + ast.literal_eval() (#10) Co-authored-by: Marc Sabatier --- django_q/cluster.py | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/django_q/cluster.py b/django_q/cluster.py index 7f2bbbf..87c8077 100644 --- a/django_q/cluster.py +++ b/django_q/cluster.py @@ -603,10 +603,15 @@ def scheduler(broker: Broker = None): # get args, kwargs and hook if s.kwargs: try: - # eval should be safe here because dict() - kwargs = eval(f"dict({s.kwargs})") - except SyntaxError: - kwargs = {} + # first try the dict syntax + kwargs = ast.literal_eval(s.kwargs) + except (SyntaxError, ValueError): + # else use the kwargs syntax + try: + parsed_kwargs = ast.parse(f"f({s.kwargs})").body[0].value.keywords + kwargs = {kwarg.arg: ast.literal_eval(kwarg.value) for kwarg in parsed_kwargs} + except (SyntaxError, ValueError): + kwargs = {} if s.args: args = ast.literal_eval(s.args) # single value won't eval to tuple, so: