ASTEVAL: Minimal Python AST Evaluator¶
The asteval package evaluates Python expressions and statements, providing
a safer alternative to Python’s builtin
eval() and a richer,
easier to use alternative to
ast.literal_eval(). It does this by
building an embedded interpreter for a subset of the Python language using
ast module. The emphasis and main area of application
is the evaluation of mathematical expressions. Because of this emphasis,
mathematical functions from Python’s
math module are built-in to
asteval, and a large number of functions from numpy will be available if
numpy is installed on your system.
While the primary goal is evaluation of mathematical expressions, many features and constructs of the Python language are supported by default. These features include array slicing and subscripting, if-then-else conditionals, while loops, for loops, try-except blocks, list comprehension, and user-defined functions. All objects in the asteval interpreter are truly Python objects, and all of the basic built-in data structures (strings, dictionaries, tuple, lists, sets, numpy arrays) are supported, including the built-in methods for these objects.
However, asteval is by no means an attempt to reproduce Python with its own
ast module. There are important differences and missing features
compared to Python. Many of these absences are intentional, and part of
the effort to try to make a safer version of
eval(), while some
are simply due to the reduced requirements for an embedded mini-language.
These differences and absences include:
Variable and function symbol names are held in a simple symbol table - a single dictionary - giving a flat namespace.
creating classes is not allowed.
importing modules is not allowed.
f-strings, function decorators, generators, yield, type hint, and lambda are not supported.
Accessing several private object attributes that can provide access to the python interpreter are not allowed.
The resulting “asteval language” acts very much like miniature version of Python, focused on mathematical calculations, and with noticeable limitations. It is the kind of toy programming language you might use to introduce simple scientific programming concepts.
Because asteval is designed for evaluating user-supplied input, safety
against malicious or incompetent user input is an important concern.
Asteval tries as hard as possible to prevent user-supplied input from
crashing the Python interpreter or from returning exploitable parts of the
Python interpreter. In this sense asteval is certainly safer than using
eval(). However, asteval is an open source project written by
volunteers, and we cannot guarantee that it is completely safe against
- Downloading and Installation
- Motivation for asteval
- Using asteval
- asteval reference