[Jython-users] Re: Dynamic invocation of Java objects within PythonInterpreter

[Randy P. <ran...@re...>]

> String rule = //get rule string from the database
> PythonInterpreter pi = new PythonInterpreter();
> pi.set("aPerson.address.zipcode", aPerson.address.zipcode);
> pi.set("aPerson.address.countryCode", aPerson.address.countryCode);
> PyObject po = pi.eval(rule);

Be careful.

There is a security risk in letting users type in Python code as a input 
String, and evaluating that code.

Here are some links:

http://mail.python.org/pipermail/python-bugs-list/2001-November/008236.html
http://diveintomark.org/archives/2002/01/04/eval_is_evil