From: coigner <coignerATgmail@...>
Date: 2008-03-09T02:24:55+09:00
Subject: Re: Dynamic class thingies? (Okay, not sure how to title this one)

On Fri, 07 Mar 2008 18:17:13 -0500, Arlen Cuss wrote:

> [Note:  parts of this message were removed to make it a legal post.]
> 
> Hi,
> 
> On Sat, Mar 8, 2008 at 3:24 AM, coigner <coignerATgmail@spammers.fry>
> wrote:
> 
>> Does and thanks. Though I'd already started getting it to work with
>> eval. Which do you think is better? Or does it matter?
> 
> 
> I think const_get - in general, though not always - is better. It's a
> very broad tool, and doesn't convey your intentions correctly. It also
> means that if -- somehow -- some unsafe input ends up in eval, a
> malicious user could put whatever they want and have the code executed
> (e.g. "File.unlink('/*')" ..), whereas there's not so much a threat with
> const_get.

That's not so much a problem in this case as the code in question is all 
"behind the scenes" and doesn't deal with user input. In fact, it's all 
meant to be "back end" stuff that users don't deal with directly. 

But now that you mention it, I do need to put on the "to do" list that I 
should go over the way the SQL is handled. That would be the weakest 
point in what I'm doing though the actual SQL is already pretty isolated. 
There isn't any "pass me a SQL string and I'll use it blindly" going on.