Skip to main content

Notebooks

📄️Expression Evaluator

Pricing formulas in ducto are plain strings: inputtokens * 5 + outputtokens * 15. But executing arbitrary strings as code is dangerous -- that is how injection attacks happen. A naive approach would use eval() to turn a string into a number, but eval() can execute any Python expression, including calls to import (to import the os module), open() (to read files), or globals() (to inspect runtime state). This is like giving a stranger the keys to every room in your house.