My bad, and I know it's not easy to defer cheating. I think I managed to solve the worst of that via regex validation, but of course there's still ways - like __import__ with getattr and split string literals. Those are not easy to solve, and my miserable regex skills are probably not enough.
Thanks for the feedback, though!
This comment is hidden because it contains spoiler information about the solution
Returning the list here is technically bad practice, because there's an assumption that a function that returns a value doesn't have side-effects - and vice-versa, functions that have side effects return None. When a function does both, it gives a false sense of security to someone who isn't familiar with it doing both.