subpattern where-python:`arbitrary python code` about semgrep HOT 7 CLOSED

and now we are sensitive to command/eval injection!

from semgrep.

This is why you use a scripting language for, to script! to leverage eval()! (there is no other use for those languages IMHO :) )

from semgrep.

Ohoho, oh yes!
I can then scratch one of the items in https://returntocorp.quip.com/flmmAhOAzbj9/Pads-long-term-goals

from semgrep.

(is there a sandbox mode in python like in Perl?)

from semgrep.

I'd like to throw a suggestion in the ring here... can we point to a separate python file? It would be nice to, e.g., lint that file.

from semgrep.

I don't understand what you want nathan. Can you give an example of what you want?

from semgrep.

@aryx I think @nbrahms means, a way to say:

pattern-where-python-file-returns-true: pass_me_metavars.py

And then have that python file be invoked with the metavars as CLI arguments and return code being true/false for the filter.

from semgrep.