tree 16b8823424a3726cbcd52b7f68f47318599c2631
parent 90d62ab0a175b8f3451ee74f29d5de83650e2292
author Guido van Rossum <guido@python.org> 881794795 +0000
committer Guido van Rossum <guido@python.org> 881794795 +0000
HG:extra convert_revision:svn%3A6015fed2-1504-0410-9fe1-9d1591cc4771/python/branches/legacy-trunk%409299

At Barry's suggestion, plug the security leak by using an empty
__builtins__ for all calls to eval().  This still allows someone to
write string.atof("[1]*1000000") (which Jim Fulton worries about) but
effectively disables access to system modules and functions.