Safe string formatting in Python I am a fan of f"{strings}" in Python,

However some situations could possibly be dangerous when doing f strings from user input, leaking API keys or even code execution!

So I decided to make something to mitigate these attacks. It works by searching with regex over the input string, and will return an empty string if it detects any evil piece of code.

It uses the fmt package

import fmt as f
import re
import os # This is for checking the system call

import doctest

# Setup
SECRET_GLOBAL = 'this is a secret'

class Error:
    def __init__(self):
        passs

def a_function():
    return SECRET_GLOBAL

# Here is where the code begins
DANGEROUS_CODES = [
                    re.compile(r'(\.system\(.*\))'),    # Any call to system
                    re.compile(r'(__[\w]+__)'),         # Any internals
                    re.compile(r'([\w\d]+\(\))')        # Functions
                  ]

def safe_format(st):
    '''
    Safe python f-string formatting
    this will detect evil code from fstring making formatting safe.

    args:
        st (str): The f-string

    returns:
        Empty string, if dangerous code is found
        Executes the fstring normally if no dangerous code is found

    Test globals acces
    &gt;&gt;&gt; safe_format('{Error().__init__.__globals__[SECRET_GLOBAL]}')
    ''

    Test function acces
    &gt;&gt;&gt; safe_format('a_function()')
    ''

    Test code execution via import
    &gt;&gt;&gt; safe_format('{__import__("os").system("dir")}')
    ''

    Test code execution with imported os
    &gt;&gt;&gt; safe_format('{os.system("dir")}')
    ''

    Test no stack trace
    &gt;&gt;&gt; safe_format('{0/0}')
    ''

    Test acceptable fstring
    &gt;&gt;&gt; safe_format('{6 * 6}')
    '36'
    '''
    if any(re.search(danger, st) for danger in DANGEROUS_CODES):
        return ''

    try:
        return f(st)
    except Exception as e:
        return ''

if __name__ == '__main__':
    doctest.testmod()



Did i miss anything?
Is this approach acceptable?
If you forbid function calls you cannot use getters which then is a big restriction. If you allow them it is hard to get it safe. Also your regexes will have collateral damages and filter legal expressions. So I think your approach is not so good. Don't allow users to mess with format strings. Use Template from string for that purpose.

to your regexes:


if you have a re for function you do not need one for system
[\w] includes [\d]
your re function catches only calls without arguments
re function and re system do not care about whitespaces and are vulnerable
all regexes do collateral damage when matching outside the format braces


here are some more test that currently fail

    '''
    some attacks
    &gt;&gt;&gt; safe_format('a_function(666)')
    ''

    &gt;&gt;&gt; safe_format('a_function ()')
    ''

    &gt;&gt;&gt; safe_format('{os. system("dir")}')
    ''

    some collateral damage
    &gt;&gt;&gt; safe_format('...system(left) {5}')
    '...system(left) 5'

    &gt;&gt;&gt; safe_format('f() gives {5}')
    'f(g) gives 5'

    '''