fix security problem

It is not safe to use eval function because input data(request body) is not checked

For example, someone can send this data to remove all files in the directory

"import('os').system('rm -rf .')"

I suggest to use json.loads to parse the request body if the data is json format

or disable builtin functions like:

eval(req.body, {"__builtins__":None})