Use of eval()

[deyceg]

I don't see any sanitizing of custom rules so you'd be able to execute arbitrary python code.

[Andrey9kin]

@deyceg Thank you for reporting this and yes eval is dangerous.

Do you see any low-hanging fruits that would help to mitigate this? I have been thinking of replacing eval with a rule engine but at the moment everything that I have seen is quite complex for comprehension and would prevent users from writing their own rules...

[Andrey9kin]

reading it one more time now and yes, we could try to do sanitization. will look into it