[doc] exec-used, add a full example writing in an intermediary file (#9913)

Author: Pierre-Sassoulas

doc/data/messages/e/exec-used/details.rst

@@ -2,9 +2,53 @@ The available methods and variables used in ``exec()`` may introduce a security
 You can restrict the use of these variables and methods by passing optional globals
 and locals parameters (dictionaries) to the ``exec()`` method.
 
-However, use of ``exec`` is still insecure. For example, consider the following call
-that writes a file to the user's system:
+However, use of ``exec()`` is still insecure if you allow some functions like
+``__import__`` or ``open``. For example, consider the following call that writes a
+file to the user's system and then execute code unrestrained by the ``allowed_globals``,
+or ``allowed_locals`` parameters:
 
 .. code-block:: python
 
-    exec("""\nwith open("file.txt", "w", encoding="utf-8") as file:\n file.write("# code as nefarious as imaginable")\n""")
+    import textwrap
+
+
+    def forbid_print(*args):
+        raise ValueError("This is raised when a print is used")
+
+
+    allowed_globals = {
+        "__builtins__": {
+            "__import__": __builtins__.__import__,
+            "open": __builtins__.open,
+            "print": forbid_print,
+        }
+    }
+
+    exec(
+        textwrap.dedent(
+            """
+        import textwrap
+
+        with open("nefarious.py", "w") as f:
+            f.write(textwrap.dedent('''
+                def connive():
+                    print("Here's some code as nefarious as imaginable")
+            '''))
+
+        import nefarious
+
+        nefarious.connive()  # This will NOT raise a ValueError
+        """
+        ),
+        allowed_globals,
+    )
+
+
+The import is used only for readability of the example in this case but it could
+import a dangerous functions:
+
+- ``subprocess.run('echo "print(\"Hello, World!\")" > nefarious.py'``
+- ``pathlib.Path("nefarious.py").write_file("print(\"Hello, World!\")")``
+- ``os.system('echo "print(\"Hello, World!\")" > nefarious.py')``
+- ``logging.basicConfig(filename='nefarious.py'); logging.error('print("Hello, World!")')``
+- etc.

doc/data/messages/e/exec-used/good.py

@@ -3,7 +3,9 @@ def get_user_code(name):
 
 
 username = "Ada"
-allowed_globals = {"__builtins__": None}
-allowed_locals = {"print": print}
+# If the globals dictionary does not contain a value for the key __builtins__,
+# all builtins are allowed. You need to be explicit about it being disallowed.
+allowed_globals = {"__builtins__": {}}
+allowed_locals = {}
 # pylint: disable-next=exec-used
 exec(get_user_code(username), allowed_globals, allowed_locals)

doc/data/messages/e/exec-used/related.rst

@@ -1 +1,2 @@
 - `Be careful with exec and eval in Python <https://lucumr.pocoo.org/2011/2/1/exec-in-python/>`_
+- `Python documentation <https://docs.python.org/3/library/functions.html#exec>`_