实现Web端点接收代码功能，如何提取函数依赖的导入模块？

Absolutely, you can extract the imported modules from user-submitted functions—even when they rely on libraries like arcpy, pandas, or numpy. Here’s how to approach it, depending on your workflow and needs:

1. Static Analysis (Most Reliable for Explicit Imports) #

Use Python’s built-in ast module to parse the function’s source code and detect import statements directly. This works great for standard imports (like import arcpy or from pandas import DataFrame) without needing to execute the function.

Here’s a quick implementation:

import ast
import inspect

def extract_explicit_imports(func):
    # Grab the source code of the submitted function
    func_source = inspect.getsource(func)
    # Parse the code into an Abstract Syntax Tree
    tree = ast.parse(func_source)
    
    imported_modules = set()
    # Traverse all nodes in the AST
    for node in ast.walk(tree):
        # Handle top-level imports (e.g., import arcpy)
        if isinstance(node, ast.Import):
            for alias in node.names:
                # Capture the top-level module (ignore submodules like arcpy.sa)
                imported_modules.add(alias.name.split('.')[0])
        # Handle from-imports (e.g., from numpy import array)
        elif isinstance(node, ast.ImportFrom):
            if node.module:
                imported_modules.add(node.module.split('.')[0])
    
    return list(imported_modules)

# Example test function
def user_submitted_func():
    import arcpy
    import pandas as pd
    from numpy.linalg import norm
    arcpy.env.workspace = "C:/data"
    df = pd.read_csv("data.csv")
    return norm(df.values)

# Extract imports
print(extract_explicit_imports(user_submitted_func))  # Output: ['arcpy', 'pandas', 'numpy']

2. Dynamic Analysis (For Implicit/Dynamic Imports) #

If users use dynamic imports (e.g., __import__("arcpy") or conditional imports that only run under certain conditions), static analysis might miss them. In this case, you can track imports while executing the function (warning: only do this in a secure sandbox environment):

import sys

def track_runtime_imports(func):
    # Record the state of loaded modules before execution
    initial_modules = set(sys.modules.keys())
    
    # Execute the function (use extreme caution with untrusted user code!)
    func()
    
    # Find modules that were loaded during execution
    new_modules = set(sys.modules.keys()) - initial_modules
    # Filter down to top-level modules
    top_level_modules = {mod.split('.')[0] for mod in new_modules}
    
    return list(top_level_modules)

Critical Safety Notes #

Since you’re building a web endpoint that accepts user code and uses pickle, security is non-negotiable:

• Pickle is not secure for untrusted data: Maliciously crafted pickles can execute arbitrary code when deserialized. Never unpickle data from untrusted sources without a secure sandbox (e.g., isolated Docker containers, restricted execution environments like PyPy Sandbox).
• For executing user functions, always run code in a sandbox with limited permissions (no access to filesystem, network, etc.).
• Consider replacing pickle with safer alternatives like cloudpickle (still not 100% safe for untrusted code, but more robust for serializing functions) or serializing just the function source code instead of the pickled object.

Handling Pickle-Serialized Functions #

If you’re receiving pickled functions, you’ll need to unpickle them first (in a sandbox!) before running either of the above analysis methods. Alternatively, have the client send both the pickled function and the pre-extracted import list (to avoid unpickling untrusted data immediately).

内容的提问来源于stack exchange，提问作者code base 5000