From: Glenn Parker Date: 2004-12-31T01:03:09+09:00 Subject: Re: #send and private methods Brian Palmer wrote: > Then I would just have the > interpreter do a #send with whatever the user typed in, and let > #method_missing handle the "I don't understand what you mean" type > messages. I expect this would be a fairly easy system to compromise. Think of all the cross-scripting hacks that web developers have to guard against today, hence the tainted concept. If you really trust your users, or if you don't care what happens to your computer, then OK. Otherwise, you should maintain strict isolation between user input and executable code. -- Glenn Parker | glenn.parker-AT-comcast.net |