Security: Avoid running code for static parser

[de-code]

The static parser contains an eval statement. In general it's probably good to use eval as little as possible.
I could see r2t2 being used on untrusted source to find references. Having eval may run arbitrary code (or even if the syntax parsed doesn't allow it, it would be easier to affirm that this is not the case).

[dalonsoa]

Yes, probably that one can be avoided. We can look for a workaround that.