HardPro challengePython

Avoid eval() for Parsing Input

PythonSecurity

The function below parses three numeric form fields using eval().

The bug: eval() runs its argument as Python with full access to the current scope. Any user who can control the input string can run arbitrary code on the server.

pre_tax = eval(pre_tax_input)
after_tax = eval(after_tax_input)
roth = eval(roth_input)

Your task: fix solve(pre_tax_input, after_tax_input, roth_input) so it returns {'pre_tax': ..., 'after_tax': ..., 'roth': ...} with each field safely parsed as a number — using None for any input that isn't a valid, finite number.

solve('500', '1200', '0')  # → {'pre_tax': 500, 'after_tax': 1200, 'roth': 0}
solve('1 + 1', '0', '0')   # → {'pre_tax': None, 'after_tax': 0, 'roth': 0}  (never executed as code)

Sample tests

Test #1Valid numeric strings
Input: ["500","1200","0"]
Output: {"roth":0,"pre_tax":500,"after_tax":1200}
Test #2Expression string rejected, not evaluated
Input: ["1 + 1","0","0"]
Output: {"roth":0,"pre_tax":null,"after_tax":0}
Test #3Code-execution payload stays inert, never runs
Input: ["__import__('os').system('whoami')","0","0"]
Output: {"roth":0,"pre_tax":null,"after_tax":0}