eval, pickle and shell=True

def parse_settings(text: str) -> dict[str, object]:
    """Turn text such as "{'width': 80, 'tags': ['a']}" into a dict."""
    # eval runs any expression in text. Use ast.literal_eval, and raise
    # ValueError unless the result is a dict with only str keys.
    return eval(text)

from main import parse_settings


def rejects(text):
    try:
        parse_settings(text)
    except ValueError:
        return True
    return False


def test_literal_dict():
    """A dict of literals is parsed"""
    got = parse_settings("{'width': 80, 'tags': ['a', 'b'], 'theme': None}")
    assert got == {"width": 80, "tags": ["a", "b"], "theme": None}, f"parse_settings gave {got!r}"


def test_rejects_call():
    """A function call in the text is refused, not run"""
    assert rejects("{'n': len('abc')}"), "{'n': len('abc')} was accepted: eval ran len(); use ast.literal_eval"


def test_rejects_name():
    """A variable name in the text is refused"""
    assert rejects("{'n': width}"), "a name in the text was accepted or raised the wrong error"


def test_rejects_non_dict():
    """A list is not settings"""
    assert rejects("[1, 2]"), "[1, 2] was accepted; raise ValueError unless the result is a dict"


def test_rejects_non_str_key():
    """Keys must be strings"""
    assert rejects("{1: 'a'}"), "{1: 'a'} was accepted; every key must be a str"

import pickle


def dump_scores(scores: dict[str, int]) -> str:
    """Save scores as text that another program can read back."""
    return pickle.dumps(scores).hex()


def load_scores(text: str) -> dict[str, int]:
    """Read scores saved by dump_scores; raise ValueError for anything else."""
    return pickle.loads(bytes.fromhex(text))

import json
import pickle

from main import dump_scores, load_scores


class Alarm:
    def __reduce__(self):
        return (print, ("alarm",))


def rejects(text):
    try:
        load_scores(text)
    except ValueError:
        return True
    return False


def test_round_trip():
    """Scores survive dump and load"""
    scores = {"ada": 3, "bob": 5}
    got = load_scores(dump_scores(scores))
    assert got == scores, f"load_scores(dump_scores(...)) gave {got!r}"


def test_readable_json():
    """dump_scores writes JSON that any program can read"""
    text = dump_scores({"ada": 3})
    try:
        got = json.loads(text)
    except ValueError:
        got = None
    assert got == {"ada": 3}, f"dump_scores wrote {text[:40]!r}, which is not JSON"


def test_refuses_pickle():
    """A pickle is refused with ValueError, and nothing in it runs"""
    blob = pickle.dumps(Alarm()).hex()
    assert rejects(blob), "load_scores accepted a pickle: it could run code while loading"


def test_checks_types():
    """A score that is not an integer is refused"""
    assert rejects('{"ada": "three"}'), 'load_scores accepted {"ada": "three"}'

import json
import subprocess
import sys

CHILD = "import json, sys; print(json.dumps(sys.argv[1:]))"


def child_args(words: list[str]) -> list[str]:
    """Run CHILD in a new Python process with words as its arguments; return what it received."""
    # A shell splits, expands and interprets the words. Pass a list instead.
    command = f'"{sys.executable}" -c "{CHILD}" ' + " ".join(words)
    result = subprocess.run(command, shell=True, capture_output=True, text=True)
    return json.loads(result.stdout)

from main import child_args


def test_simple():
    """Two plain words arrive as two arguments"""
    got = child_args(["a", "b"])
    assert got == ["a", "b"], f"the child received {got!r}"


def test_spaces():
    """A word with a space stays one argument"""
    got = child_args(["two words"])
    assert got == ["two words"], f"the child received {got!r}: no shell, pass a list"


def test_special_characters():
    """$HOME and an apostrophe arrive unchanged"""
    got = child_args(["$HOME", "it's"])
    assert got == ["$HOME", "it's"], f"the child received {got!r}: a shell expanded or broke them"