title: How can locals() be exploited in python code?
body: <p>I stumbled across the following warning when I was reading <a href="http://python.net/~goodger/projects/pycon/2007/idiomatic/handout.html">Code Like a Pythonista: Idiomatic Python</a> by David Goodger.</p>
  
  <blockquote>
    <p>Excerpt from the article ...</p>
  
  <pre><code>print('Hello %(name)s, you have %(messages)i messages' % locals())
  </code></pre>
    
    <p>This is very powerful. With this, you
    can do all the string formatting you
    want without having to worry about
    matching the interpolation values to
    the template.</p>
    
    <p><strong>But power can be dangerous. "With great power comes great
    responsibility." If you use the
    <code>locals()</code> from with an
    externally-supplied template string,
    you expose your entire local namespace
    to the caller. This is just something
    to keep in mind.</strong></p>
  </blockquote>
  
  <p>I am trying to understand the <em>specific scenarios</em> in which using <code>locals()</code> can be dangerous. Any examples of how the presence of <code>locals()</code> in a code can be exploited are appreciated. Thanks!</p>