SEC: Remove eval() from validate_cycler - #31248

Merged

tacaswell merged 9 commits into

matplotlib:mainfrom

scottshambaugh:rcparam_eval

Mar 27, 2026

Commits on Mar 26, 2026

Remove eval() from validate_cycler, which might allow code execution through a malicious matplotlibrc
scottshambaugh
committed
27e34b0
Test that validate_cycler does not execute code passed in
scottshambaugh
committed
9e7e141
Whats new for prop_cycle rcparam
scottshambaugh
committed
f974ca8
Support and test cycler integer multiplication, concat, and slicing
scottshambaugh
committed
3016cc7
Consolidate tests
scottshambaugh
committed
408ad1c
Deprecation notice
scottshambaugh
committed
2b02b0c
Code review updates
scottshambaugh
committed
e01b8a4
Code review update
scottshambaugh
committed
bb6eb29
Recursively eval cycler kwargs
scottshambaugh
committed
99d07bc