in 1.2.x, you would need to use the

python-eval

task from contrib to get the sandbox enforced