Replace use of eval() by ast.parse() + ast.literal_eval() (#10)

Co-authored-by: Marc Sabatier <marc@sabatier.online>

django_q/cluster.py

@@ -603,10 +603,15 @@ def scheduler(broker: Broker = None):
                 # get args, kwargs and hook
                 if s.kwargs:
                     try:
-                        # eval should be safe here because dict()
+                        # first try the dict syntax
-                        kwargs = eval(f"dict({s.kwargs})")
+                        kwargs = ast.literal_eval(s.kwargs)
-                    except SyntaxError:
+                    except (SyntaxError, ValueError):
-                        kwargs = {}
+                        # else use the kwargs syntax
+                        try:
+                            parsed_kwargs = ast.parse(f"f({s.kwargs})").body[0].value.keywords
+                            kwargs = {kwarg.arg: ast.literal_eval(kwarg.value) for kwarg in parsed_kwargs}
+                        except (SyntaxError, ValueError):
+                            kwargs = {}
                 if s.args:
                     args = ast.literal_eval(s.args)
                     # single value won't eval to tuple, so: