From: "David A. Black" <dblack@...>
Date: 2008-04-20T22:53:46+09:00
Subject: Re: Executing code in a variable

Hi --

On Sun, 20 Apr 2008, Robert Klemme wrote:

> On 20.04.2008 14:50, David A. Black wrote:
>> Hi --
>> 
>> On Sun, 20 Apr 2008, christiantheilhave@gmail.com wrote:
>> 
>>> On Apr 20, 11:43 am, Zangief Ief <z4n9...@gmail.com> wrote:
>>>> Hello,
>>>> 
>>>> I have a Ruby code stocked into a Ruby variable like this:
>>>> 
>>>> buffer = ' puts "Hello World!" '
>>>> 
>>>> Is there a way for execute the current code by using buffer variable ?
>>>> 
>>>> Thanks
>>>> --
>>>> Posted viahttp://www.ruby-forum.com/.
>>> Sure, you can use eval, eg.
>>> 
>>> irb(main):002:0> eval 'puts "Hello world"'
>>> Hello world
>>> => nil
>>> 
>>> However, eval should be usually avoided. Instead Ruby has the methods
>>> instance_eval, class_eval and module_eval, which works the same as
>>> eval but the argumented is executed in the scope of the current object/
>>> class/module.
>> 
>> The main advantage of instance/class/module_eval over eval, though, is
>> that they can take a block and therefore you don't have to evaluate a
>> string. If you do this:
>>
>>    obj.instance_eval(str)
>> 
>> it's no better or worse, from the point of view of safety, than using
>> eval.
>
> It is slightly better because with #instance_eval you can control what "self" 
> is set to and avoid a certain class of issues:
>
> irb(main):001:0> class Foo
> irb(main):002:1> attr_accessor :bar
> irb(main):003:1> def work1(s)
> irb(main):004:2> eval s
> irb(main):005:2> end
> irb(main):006:1> def work2(s)
> irb(main):007:2> Object.new.instance_eval(s)
> irb(main):008:2> end
> irb(main):009:1> end
> => nil
> irb(main):010:0> f=Foo.new
> => #<Foo:0x7ff7acf4>
> irb(main):011:0> f.bar="important"
> => "important"
> irb(main):012:0> f.work2 "@bar='messed'"
> => "messed"
> irb(main):013:0> f.bar
> => "important"
> irb(main):014:0> f.work1 "@bar='messed'"
> => "messed"
> irb(main):015:0> f.bar
> => "messed"
> irb(main):016:0>
>
> But this is just a gradual difference - there is still enough damage that can 
> be done by evaluating strings or arbitrary code.
>
> irb(main):016:0> f.work2 "puts 'ooops!';exit 1"
> ooops!

That's the thing -- I think it's more a string thing, and the dangers
of untrusted input (which can really do anything), than the question
of what self is, since the untrusted input problem can always reassert
itself.


David

-- 
Rails training from David A. Black and Ruby Power and Light:
   INTRO TO RAILS         June 9-12            Berlin
   ADVANCING WITH RAILS   June 16-19           Berlin
   INTRO TO RAILS         June 24-27           London (Skills Matter)
See http://www.rubypal.com for details and updates!