This is a rather weird use-case, however, a project we are developing needs a way for it to store user-defined functions and run them within views. The function code will be stored in a TextField in a model.
The functions themselves would be ideally very simple, mostly involving arithmetic operations, if-else blocks, and loops. The functions can also be in any language, as long as Python is able to run them somehow.
The obvious problem is the possible security issues, since it is always best to assume the code will come from untrusted sources. Anyway, we have thought about these possible solutions:
- Storing Python functions as strings, and running them using
eval(). - Storing Javascript functions as strings, and running them using Js2Py.
- Creating a simple programming language, a subset of Python, which removes all the methods and operators which could possible cause security issues. The function would therefore be written in this new language.
What is my best option? Obviously, the first two options are very insecure, while the third one is hard to implement. Is there a better way to do this?
