Registry / serialization / leval
library1.3.0pypypi✓ verified 80d ago

leval is a Python library that provides a safe and limited evaluator for untrusted Python expressions, aiming to prevent arbitrary code execution while allowing controlled calculations. It is currently at version 1.3.0 and actively maintained, with recent updates focusing on feature enhancements and internal improvements.

pip install leval
INSTALL
IMPORT
SIG · LEVAL
L
leval
serializationpythonv1.3.0
Install
1.7s avg
Import
Disk
16MB
Pass rate
10/ 10
Env Coverage10 / 10
glibc
3.93.13
musl
3.93.13
Install & Compatibility
Where this runs
tested against v1.3.0 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
py 3.103.910 runs
installs and imports cleanly · install 0.0s · import 0.000s · 17.9MB
glibc
py 3.103.910 runs
installs and imports cleanly · install 1.7s · import 0.000s · 18MB
16MB installed
● package 16MB
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

evaluate
import leval
from leval import evaluate

This quickstart demonstrates how to use `leval.simple.evaluate` for evaluating expressions with provided context, including basic arithmetic, string manipulation, and conditional logic. It also highlights the `loose_is_is_not` parameter for controlling identity operator behavior introduced in version 1.2.0.

from leval.simple import evaluate # Basic evaluation with context expression_1 = "x * (y + 2)" context_1 = {"x": 5, "y": 3} result_1 = evaluate(expression_1, **context_1) print(f"'{expression_1}' with context {context_1} evaluates to: {result_1}") # Evaluation with string methods and built-in functions expression_2 = "s.upper() + ' WORLD!' if len(s) > 5 else s.lower()" context_2 = {"s": "hello"} result_2 = evaluate(expression_2, **context_2) print(f"'{expression_2}' with context {context_2} evaluates to: {result_2}") # Explicitly opting out of loose 'is/is not' behavior introduced in v1.2.0 # For example, '0 is False' would evaluate to True with default 'loose_is_is_not=True' expression_3 = "my_value is None" context_3 = {"my_value": 0} result_3_loose = evaluate(expression_3, **context_3) result_3_strict = evaluate(expression_3, loose_is_is_not=False, **context_3) print(f"'{expression_3}' (0 is None) with loose_is_is_not (default): {result_3_loose}") print(f"'{expression_3}' (0 is None) with loose_is_is_not=False: {result_3_strict}")
Debug
Known issues
gotchaThe default behavior of `is` and `is not` operators was changed in v1.2.0 to be 'loose', meaning expressions like `0 is False` or `'' is None` might evaluate to `True`.
fix
If strict identity (`id()`) comparison is required, set `loose_is_is_not=False` when calling `evaluate()` or initializing `Leval`.
affects: >=1.2.0
breakingIn v1.2.0, a new specific exception type, `leval.exceptions.InvalidAttributeError`, was introduced for attempts to access non-existent attributes. Previously, this might have raised a generic `AttributeError`.
fix
Update exception handling logic to specifically catch `leval.exceptions.InvalidAttributeError` if you need to differentiate it, or ensure you're catching `AttributeError` (which it subclasses).
affects: >=1.2.0
gotcha`leval` is designed as a *limited* evaluator, not a full sandbox. While it blocks many dangerous operations, careful control of the `globals` and `locals` context is crucial to prevent unintended side effects or exposure of sensitive objects.
fix
Always audit the objects and functions exposed in the evaluation context (`**context`, `globals`, `locals`) to ensure they do not introduce security vulnerabilities or allow access beyond what is intended.
affects: All versions
Upgrade
Version history
1.3.0latest on PyPI · released Jul 16, 2024
Audit
Dependencies

No dependency data recorded yet.

Agent activity
23 hits · last 30 days
node
22
OpenAI (training)
1
Resources
leval — pip install leval · libregistry