Using an eval() server side in a Python/Django application -

eval evil, rm -rf /, etc etc...

but lets silly reason want leverage power of eval basic computations , conditionals.

i want idea of potential risks having eval block sitting around in server side code, , can in order mitigate them.

for starters, eval run against user input... scarier know. these super users, who, in theory can trusted, disgruntled former employees , thing.

the intended use of input provide formula used calculations against spreadsheet parsed. example, intended input like:

({{column a}} + {{column b}}) * {{column c}} 

a regex engine run on value replace curly bracket values appropriate column values, turn statement like:

(5 + 6) * 11 

however, left alone, recognize like:

from subprocess import call; call(["rm", "-rf", "/"]) 

so, idea come clean method allow for: 1) string values valid 2) within brackets valid since won't eval'd 3) nothing else containing alphanumeric characters valid.

what i've got far is:

import re django import forms  def eval_template_clean(self, value, fieldname):     # remove bracket items replaced , not evaluated     value = re.sub("{{.*?}}", "", value)     # remove string values valid     value = re.sub("\".*?\"", "", value)     value = re.sub("\'.*?\'", "", value)     # if alpha characters remain, throw error     if re.search('[a-za-z]', value):         raise forms.validationerror(             {fieldname: ['all base belong us']}         ) 

which gets run on model save method, disallowing arbitrary alphanumeric commands hanging around.

are there flaws/other risks i'm missing approach?