ast.literal_eval is still referred to as safe by the documentation for eval

Documentation

From https://docs.python.org/3/library/functions.html#eval:

See ast.literal_eval() for a function that can safely evaluate strings with expressions containing only literals.

Linked PRs

gh-100305: Deemphasize that ast.literal_eval is safe in eval documentation #100326
[3.14] gh-100305: Deemphasize that ast.literal_eval is safe in eval documentation (GH-100326) #148420
[3.13] gh-100305: Deemphasize that ast.literal_eval is safe in eval documentation (GH-100326) #148421

Could you please elabourate about it, I would like to work on this but I can't get what the issue is trying to say.

@ramvikrams

@ramvikrams Have you read literal_eval's documentation?

@ramvikrams

@ramvikrams Have you read literal_eval's documentation?

yes, I read it now earlier I read ast.literal_eval from a different source I saw there was a warning there I'll put the warning in the eval documentation

Could you please elabourate about it, I would like to work on this but I can't get what the issue is trying to say.

From the docs for literal_eval:

This function had been documented as “safe” in the past without defining what that meant. That was misleading.... [It] is not free from attack.

Python 3.11 changed the documentation to no longer refer to the function as "safe" due to the misleading vagueness of the term (see #95588), but this entry under eval() seems to have been missed.

Could you please elabourate about it, I would like to work on this but I can't get what the issue is trying to say.

From the docs for literal_eval:

This function had been documented as “safe” in the past without defining what that meant. That was misleading.... [It] is not free from attack.

Python 3.11 changed the documentation to no longer refer to the function as "safe" due to the misleading vagueness of the term (see #95588), but this entry under eval() seems to have been missed.

thanks i'll change it

Your proposed replacement text looks weirdly out of place and negative to me:

ast.literal_eval is no longer marked as safe for evaluating strings with expressions containing only literals. For further information, please check the documentation for ast.literal_eval

I'd wonder why it's suddenly talking about some other function as if the reader knew about it already, as if it had been pointed out before.

I'd just weaken the "safely", like (adding "more")

See ast.literal_eval() for a function that can more safely evaluate strings with expressions containing only literals.

or (adding quote characters):

See ast.literal_eval() for a function that can "safely" evaluate strings with expressions containing only literals.

These keep introducing it properly and keep the positive tone.

And in my opinion there's no need for the extra sentence telling the reader to read the documentation for details, that's what one does anyway.

Yeah I'll do that

gh-100305: Deemphasize that `ast.literal_eval` is safe in `eval` docu…

pythongh-100305: Deemphasize that `ast.literal_eval` is safe in `eval…

[3.13] gh-100305: Deemphasize that `ast.literal_eval` is safe in `eva…

[3.14] gh-100305: Deemphasize that `ast.literal_eval` is safe in `eva…

Your proposed replacement text looks weirdly out of place and negative to me:

ast.literal_eval is no longer marked as safe for evaluating strings with expressions containing only literals. For further information, please check the documentation for ast.literal_eval

I'd wonder why it's suddenly talking about some other function as if the reader knew about it already, as if it had been pointed out before.

I'd just weaken the "safely", like (adding "more")

See ast.literal_eval() for a function that can more safely evaluate strings with expressions containing only literals.

or (adding quote characters):

See ast.literal_eval() for a function that can "safely" evaluate strings with expressions containing only literals.

These keep introducing it properly and keep the positive tone.

And in my opinion there's no need for the extra sentence telling the reader to read the documentation for details, that's what one does anyway.

Putting stuff in quotes does’t quite say “positive tone” to me…

pythongh-100305: Deemphasize that `ast.literal_eval` is safe in `eval…

Navigation Menu

Repository navigation

`ast.literal_eval` is still referred to as safe by the documentation for `eval` #100305

Documentation

Linked PRs

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

ast.literal_eval is still referred to as safe by the documentation for eval #100305

Description

Documentation

Linked PRs

Activity

ramvikrams commented on Dec 17, 2022

pochmann commented on Dec 17, 2022

ramvikrams commented on Dec 17, 2022

Zephyrkul commented on Dec 17, 2022

ramvikrams commented on Dec 17, 2022

pochmann commented on Dec 18, 2022

ramvikrams commented on Dec 18, 2022

PlaceReporter99 commented on Apr 18, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions

`ast.literal_eval` is still referred to as safe by the documentation for `eval` #100305