From: Daniel DeLorme <dan-ml@...42.com>
Date: 2007-01-22T10:24:41+09:00
Subject: Re: Recursive send

Curtis Summers wrote:
> # Dynamically with send?  Have to call three times.
> post.send(:comments).send(:first).send(:commented_at)
> 
> 
> What if the number of calls to send is variable depending on what we're
> trying to show?  In one case we might need post.posted_at for the date,
> and in another case we might need post.comments.first.commented_at for
> the date.

A word of warning: I once thought of using that same functionality in order
to post complex information from an html form, e.g.
  <textarea name="blog[text]"></textarea>
  <select name="blog[text.format]">
    <option>raw html</option>
    <option>textile</option>

But I then realized that was a major security hole. It allows an attacker
to post stuff like:
  <input name="blog[connection.drop_database.something]"
By the time the recursive send fails on "something=", the database has
already been wiped. Well, this example doesn't really work (drop_database
requires an argument), but you get the idea.

Daniel