Hugo Geoffroy added the comment:
> I would like to point out that the changes in `ast.literal_eval` may have some security risk for code that do not expect this function to return an object with user-controlled length (for example, with `2**32*'X'`). AFAIK, this is not possible with the current version of `literal_eval`.
Since the Python compiler doesn't produce ast.Constant, there is no
change in practice in ast.literal_eval(). If you found a bug, please
open a new issue.
> At least [this library](https://pypi.python.org/pypi/serpent) would have a serious risk of remote DoS :
I tried hard to implement a sandbox in Python and I failed:
https://lwn.net/Articles/574215/
I don't think that literal_eval() is safe *by design*.