1. eval is unsafe. no matter how hard you try, you will most likely leave some gaping security hole somewhere. Especially if you are parsing a web log! Try grepping for “woot” in your log. This is the first entry I see in my log:

GET /path/to/mysite/woots.txt HTTP/1.1″ 404 366 “-” “Java/1.6.0_01

the Internet is a crazy place.

2. eval makes for unreadable code. If I were to see this written in someone else’s code: eval(rule.attr, line.__dict__) I would have to stop and figure out what the hell is going on. What are all possible values of rule.attr? even if those are in comments of the docstring I am going to be annoyed that I had to read lengthy documentation where some more readable code would suffice.

How about this instead?

>>> import cgi
>>> import re
>>> expr = re.compile(r’\s*(=|>|>> input_expr = expr.split(‘ip=192.168.1.2′)
>>> input_expr
['ip', '=', '192.168.1.2']
>>> attr, op, val = input_expr
>>> line_parsed = cgi.parse_qs(‘ip=192.168.1.2&ip=192.168.1.240′)
>>> line_parsed
{‘ip’: ['192.168.1.2', '192.168.1.240']}
>>> line_matched = False
>>> for parsed_val in line_parsed.get(attr, []):
… if op == ‘=’:
… if parsed_val == val:
… line_matched = True
… break
… elif op == ‘>’:
… if parsed_val > val:
… line_matched = True
… break
… elif op == ‘<’:
… if parsed_val >> line_matched
True
>>>

much more readable, IMHO, and tailored better to what you are trying to do (that is, given this description of what you’re trying to do:))

In addition, it’s not like I’m extolling the virtues of eval as a general safety net. It works in this instance, and I’m not opposed to entertaining other ideas about what would work. However, I’m not going to rewrite this code just because eval *can* be bad *IF USED INAPPROPRIATELY*. I’ll remind everyone that just because something has the potential to be used unwisely does not make any use of that thing unwise. You can apply that to a great many things, technical or otherwise. Like a chainsaw, for example.

I can’t profess to have read the code that implements eval(). I can’t profess to know that it can’t be broken as I’ve used it. However, I’m *confident* that it’s safe the way I’ve used it, and furthermore, the context of this application is that it is run by a user against *their own logs*, so we should also consider (in *addition* to the rest) what the cost of failure is in this case.

?import sys;sys.exit();=whatever

?