Use of the exec statement could be dangerous, and should be avoided. Moreover, the exec statement was removed in Python
3.0. Instead, the built-in exec() function can be used.
Use of the exec statement is strongly discouraged for several reasons such as:
- Security Risks: Executing code from a string opens up the possibility of code injection attacks.
- Readability and Maintainability: Code executed with
exec statement is often harder to read and understand since
it is not explicitly written in the source code.
- Performance Implications: The use of
exec statement can have performance implications since the code is compiled
and executed at runtime.
- Limited Static Analysis: Since the code executed with
exec statement is only known at runtime, static code
analysis tools may not be able to catch certain errors or issues, leading to potential bugs.
Code examples
Noncompliant code example
exec 'print 1' # Noncompliant
Compliant solution
exec('print 1')
