bpo-40355: ast.literal_eval rejects malformed Dict nodes

Lib/ast.py

@@ -62,11 +62,13 @@ def literal_eval(node_or_string):
         node_or_string = parse(node_or_string, mode='eval')
     if isinstance(node_or_string, Expression):
         node_or_string = node_or_string.body
+    def _malformed(node):
+        raise ValueError(f'malformed node or string: {node!r}')
     def _convert_num(node):
         if isinstance(node, Constant):
             if type(node.value) in (int, float, complex):
                 return node.value
-        raise ValueError('malformed node or string: ' + repr(node))
+        _malformed(node)
     def _convert_signed_num(node):
         if isinstance(node, UnaryOp) and isinstance(node.op, (UAdd, USub)):
             operand = _convert_num(node.operand)
@@ -88,6 +90,8 @@ def _convert(node):
               node.func.id == 'set' and node.args == node.keywords == []):
             return set()
         elif isinstance(node, Dict):
+            if len(node.keys) != len(node.values):
+                _malformed(node)
             return dict(zip(map(_convert, node.keys),
                             map(_convert, node.values)))
         elif isinstance(node, BinOp) and isinstance(node.op, (Add, Sub)):

Lib/test/test_ast.py

@@ -965,6 +965,12 @@ def test_literal_eval_complex(self):
         self.assertRaises(ValueError, ast.literal_eval, '3+(0+6j)')
         self.assertRaises(ValueError, ast.literal_eval, '-(3+6j)')
 
+    def test_literal_eval_malformed(self):
+        malformed = ast.Dict(keys=[ast.Constant(1), ast.Constant(2)], values=[ast.Constant(3)])
+        self.assertRaises(ValueError, ast.literal_eval, malformed)
+        malformed = ast.Dict(keys=[ast.Constant(1)], values=[ast.Constant(2), ast.Constant(3)])
+        self.assertRaises(ValueError, ast.literal_eval, malformed)
+
     def test_bad_integer(self):
         # issue13436: Bad error message with invalid numeric values
         body = [ast.ImportFrom(module='time',

Misc/NEWS.d/next/Library/2020-05-02-14-24-48.bpo-40355.xTujaB.rst

@@ -0,0 +1,2 @@
+Fixed case where malformed :class:`ast.Dict` nodes could have keys or values
+thrown away by :func:`ast.literal_eval`. Patch by Curtis Bucher.