Use of eval in /cinder/volume/drivers/emc/emc_vmax_fc.py has potential security issue

[Zhang Yun]

Who could give more explanation here for what the use of eval and where the input comes from, please help make sure the use is safe. If it is coming from a user then it is a security vulnerability.

Anyone can add some comments to the code saying what it is doing?

The same concern occurred in /cinder/volume/drivers/emc/emc_vmax_common.py:

loc = volume['provider_location']
if isinstance(loc, six.string_types):
 name = eval(loc) ------------------> This line has described issue

 instancename = self.utils.get_instance_name(
 name['classname'], name['keybindings'])

[Thierry Carrez (ttx)]

I'm pretty sure this string is not user-provided, but will wait for Cinder dev's analysis.