For instance, assuming that the get_data() function gets data from the Internet, this Python code is insecure: session = False data = get_data() foo = eval(data) An attacker could supply the program with the string "session.update('authenticated'=True)" as data, which would update the session dictionary to set an authenticated key to be True.
比如说，假设 get_data() 函数从 Internet 获取数据，这个 Python 代码就是不安全的: session = False data = get_data() foo = eval(data) 一个攻击者可以让字符串 "session.update(authenticated=True)" 作为数据提供给这个程序，它将会更新 session 字典以设定一个通过身份验证的键为 True。