Pyspread - a Python-based Spreadsheet application [LWN.net]

By Forrest Cook
December 2, 2009

Pyspread is a spreadsheet program with the unusual capability of supporting Python syntax within its cells:

Pyspread is a cross-platform Python spreadsheet application. It is based on and written in the programming language Python. Instead of spreadsheet formulas, Python expressions are entered into the spreadsheet cells. Each expression returns a Python object that can be accessed from other cells. These objects can represent anything including lists or matrices.

The Pyspread feature list includes:

Released under the GPLv3 license.
Designed for cross-platform operation.
Individual cells can hold a Python expression.
Cells return Python objects such as lists and matrices.
Cells can access all of the available Python modules.
The cell grid can be three dimensional.
Unicode characters are supported.
Pyspread can import and export comma separated value (CSV) lists.
Statistics and plotting functions are available through RPy.

Pyspread version 0.0.12a was announced on November 21, 2009 by developer Martin Manns; it added some new functionality and included some bug fixes. The software is still in an early state of development: "Pyspread is currently in the Alpha stage. Feel free to try it out on your own risk. Toy with it. Send me lots of bug reports, feedback, suggestions and improvements."

Your author tried a test installation of Pyspread on an Ubuntu 9.10 system. The version 0.0.12a .zip file was downloaded and, unzipped. The installation instructions in the INSTALL file said to run python setup.py install as root. This was done and pyspread was installed in /usr/local/bin/. Pyspread was run with the command pyspread and produced the error: No module named wx. The project's SourceForge main page had more information on the required packages: "In case you do not have it already get and install Python, wxpython and numpy. If you want the examples to work, install gmpy, R and rpy." The required Ubuntu packages were named python-wxgtk2.8 and python-numpy. After installing the dependencies, Pyspread started successfully.

On the surface, Pyspread operation is similar to that of other spreadsheets, with the exception that the cells can contain the much more powerful Python expressions. The screenshot gives an example of the user interface. The Tutorial is the first place to go to learn how to use Pyspread, the FAQ may help to answer more obscure questions about the software. A few basic tutorial examples were tried and the software behaved as one would expect.

One issue that caused your author some confusion was that cells were labeled [X, Y, Z] but X was the position within the columns and Y was the position within the rows. From the Tutorial: "Each cell can access its own position in the grid through the magic variables X (row), Y (column) and Z (table)." The documentation is quite sparse at this point in the software's evolution, it could be improved by including basic spreadsheet examples such as how to calculate the sum of a row and/or column of numbers. One could imagine that it would take a document the size of a book to cover the software's full capabilities.

Some interesting questions can be raised when using a general purpose language such as Python to calculate the cell values in a spreadhseet. Could the cells be filled with values produced by a USB-connected sensor or pulled from an external web page? Could the output of a cell be sent somewhere across the network? Could it encroach on the turf of commercial software such as PV-WAVE? And of course, what are the security implications of all of this? Pyspread should be an interesting application to watch as it matures.

(Log in to post comments)

Pyspread - a Python-based Spreadsheet application

Posted Dec 3, 2009 3:33 UTC (Thu) by tnoo (subscriber, #20427) [Link]

> Could the output of a cell be sent somewhere across the network? Could
> it encroach on the turf of commercial software such as PV-WAVE?

Not sure what you mean. As far as I know PV-Wave has no features reminding
of spreadsheets (at least as of a few years ago).
PV-Wave plays in the same league as Matlab, and has been long surpassed in
features and ease of use by the Python scientific packages such as
numpy/scipy/matplotlib/chaco/mayavi.

best, tnoo

Pyspread - a Python-based Spreadsheet application

Posted Dec 3, 2009 13:04 UTC (Thu) by NRArnot (subscriber, #3033) [Link]

> Could the cells be filled with values produced by a USB-connected sensor or pulled from an external web page?
I very much hope so! BTW I've seen MS Excel (plus heaven knows what) doing this, pulling down stock prices from Yahoo. Didn't ask how it was done, as I have no interest in Microsoft-hacking.

> Could the output of a cell be sent somewhere across the network?
Same - if the cell can activate arbitrary Python code, there's no way to stop it.

> Could it encroach on the turf of commercial software such as PV-WAVE?
I immideately thought that this should be a great tool for scientists. Do all the trivial stuff like a spreadsheet, dive into Python (numpy/scipy...) libraries to do things like matrix operations and visualisation graphics.

> And of course, what are the security implications of all of this?
What security implications? I guess, maybe the risk of making programming more accessible to the non-programmer than ever before. At least on Linux (excluding use of privilege escalation exploits), anything that a non-root user does can't screw up the installed system, only his own files. Anyone in the MS universe has been living in a world where simple web-browsing might end up nuking the entire network, ever since Microsoft first discovered the internet.

>Pyspread should be an interesting application to watch as it matures.
Indeed.

Pyspread and security

Posted Dec 3, 2009 13:38 UTC (Thu) by james (subscriber, #1325) [Link]

Well, if Pyspread can access the filesystem or make system calls, then a spreadsheet is as dangerous as a program. And an untrusted spreadsheet is as dangerous as an untrusted program. At the moment, Linux users aren't used to running programs that are emailed to them. But you can bet that if Pyspread takes off, Linux users will want to email Pyspread spreadsheets around.

It's a lovely virus vector, in other words.

Pyspread and security

Posted Dec 3, 2009 16:36 UTC (Thu) by mrshiny (subscriber, #4266) [Link]

Exactly. Microsoft learned this lesson painfully over many years through macro viruses. Now macros (that is, embedded code in documents) are turned off by default and certain dangerous operations are disabled unless the macros are signed.

Pyspread is no different from Excel or even web pages in this regard in that it will need to sandbox and control what scripts can do in order to provide security for the user. Sure, a pyspread file can only hurt the files I have access to, but on my single-user system that's all my data, including my pgp keys, photo library, email contact list... etc. Proper restrictions are critical.