The function below parses three numeric form fields using eval().
The bug: eval() runs its argument as Python with full access to the current scope. Any user who can control the input string can run arbitrary code on the server.
pre_tax = eval(pre_tax_input)
after_tax = eval(after_tax_input)
roth = eval(roth_input)Your task: fix solve(pre_tax_input, after_tax_input, roth_input) so it returns {'pre_tax': ..., 'after_tax': ..., 'roth': ...} with each field safely parsed as a number — using None for any input that isn't a valid, finite number.
solve('500', '1200', '0') # → {'pre_tax': 500, 'after_tax': 1200, 'roth': 0}
solve('1 + 1', '0', '0') # → {'pre_tax': None, 'after_tax': 0, 'roth': 0} (never executed as code)Sample tests