get rid of eval #1056

Activity

1. EpicWink commented on Jun 30, 2025

   

   EpicWink

   on Jun 30, 2025

   Contributor

   More actions

   Replace with ast.literal_eval.

   The two uses are literally just loading the value for no_word_spacing from the language info, which I'm sure can be manipulated by malicious clients to run arbitrary code in protected environments in some scenarios (eg if user can add arbitrary language-info, and user provides their language/locale, and protected application uses dateparser to parse dates using provided language/locale).
2. AdrianAtZyte

   closed this as completedin #1319on Mar 26, 2026