How to avoid using exec() and eval() in Python I wrote a script to execute a service on the Forestry TEP platform via its REST API. This service has certain input parameters, some of them are numerical values, other strings or files. The current workflow is:

There is a configuration file that has options for file and literal inputs. Each option is a dictionary, where each key is equal to one parameter of the service I want to execute. Example of such file:
file_inputs= {&quot;cfg&quot; : &quot;forest_flux/FTEP_service/cfg.ini&quot;,
              &quot;parsawen&quot; : &quot;forest_flux/FTEP_service/parsawen.csv&quot;,
              &quot;weather&quot; : &quot;forestflux/data/fin_01/weather/weather_2004.csv&quot;}
literal_inputs = {&quot;version&quot; : 3}


In the script, I read the cfg and iterate over items in these dictionaries. For each key,value pair, I use exec() to store the value in a class variable of the same name. For file inputs, I first upload the file on the platform and store the file's location on the platform in the variable.
    input_files_dict = json.loads(cfg.get(&quot;service_info&quot;, &quot;file_inputs&quot;))
    for key, val in input_files_dict.items():
        exec(&quot;self.{} = self.post_data('{}')&quot;.format(key, val))

    literal_inputs_dict = json.loads(cfg.get(&quot;service_info&quot;, &quot;literal_inputs&quot;))
    for key, val in literal_inputs_dict.items():
        exec(&quot;self.{} = '{}'&quot;.format(key, val))


I request service inputs and I try to match the service parameters with my class variables. I add it to a dictionary of parameters which I then send to the platform when executing the service.
    r2 = requests.get(url = url2, verify=False, allow_redirects=False, cookies=self.session_cookies)
    data_inputs = json.loads(r2.text)['serviceDescriptor']['dataInputs']
    for _input in data_inputs:
        value_to_set = eval(&quot;self.&quot; + _input[&quot;id&quot;].lower())
        job_config[&quot;inputs&quot;][_input[&quot;id&quot;]] = [value_to_set]



This current workflow works well for me but I have strong suspicion that it is a very bad practice. I have read that using exec() and eval() is discouraged as there are security issues. However, I cannot think of a better way to achieve this functionality, i.e. to pair values in configuration with service inputs automatically. I want this script to be generic, i.e. usable for any service on the platform.
Question: How could I do this without using the problematic functions? How could using these functions be problematic in this case?
Please note that I removed a lot of code that is not related to the problem I am asking about (e.g. error handling).
You can use getattr, setattr and delattr to retrieve, modify and remove attributes respectively. This avoids most potential messes eval has.
input_files_dict = json.loads(cfg.get(&quot;service_info&quot;, &quot;file_inputs&quot;))
for key, val in input_files_dict.items():
    setattr(self, key, self.post_data(f'{value}'))