Question

I’d like to init a class from data stored in a simple python file specified while calling the script. The config file named myconfig.py is :

str='home'
val=2
flt=7.0

I’d like to call it during class initilization like so. One of the objectives is to define variable types as well in the file. I know of the configparser, but this method less verbose if it can be made to work.

class ClassInit(object):
    def __init__(self, configFile):
        fp, path, des = imp.find_module('',configFile)
        imp.load_module(configFile, fp, path, des)
        self.__dict__ = configFile.__dict__
        fp.close()

    def printVal(self):
        print '%s %0.2f'%(self.str, self.val)

if __name__ == '__main__':
    srcDir = 'src/'
    config = osp.join(srcDir, argv[0]) # config for current run 
    ci = ClassInit(config)
    ci.printVal()

Is anything like this possible?

Answer 1

Well, there are several ways to do this. The easiest way would be to use eval() or exec to evaluate this code within the class scope. But that’s also the most dangerous way, especially if these files can be created by someone other than you. In that case, the creator can write malicious code that can pretty much do anything. You can override the __builtins__ key of the globals dictionary, but I’m not sure if this makes eval/exec entirely safe. For example:

class ClassInit(object):
    def __init__(self, configFile):
        f = open(configFile)
        config = f.read()
        f.close()
        config_dic = { '__builtins__': None}
        exec 'a = 4' in config_dic
        for key, value in config_dic.iteritems():
            if key != '__builtins__':
                setattr(self, key, value)

This method kills the unsafe ‘builtins‘ object, but it’s still not quite safe. For instance, the file may be able to define a function which would override one of your class’s functions with malicious code. So I really don’t recommend it, unless you absolutely control thos .py files.

A safer but more complex way would be to create a custom interpreter that interprets this file but doesn’t allow running any custom code.

You can read the following thread, to see some suggestions for parsing libraries or other safer alternatives to eval():
Python: make eval safe

Besides, if all you ever need your config.py file for is to initialize some variables in a nice way, and you don’t need to be able to call fancy python functions from inside it, you should consider using JSON instead. Python 2.6 and up includes simplejson, which you can use to initialize an object from file. The syntax is Javascript and not Python, but for initializing variables there’s little difference there.