From: Robert Dober <robert.dober@...>
Date: 2008-04-21T02:13:35+09:00
Subject: Re: Executing code in a variable

On Sun, Apr 20, 2008 at 6:53 PM, Christopher Dicely <cmdicely@gmail.com> wrote:
>
> On Sun, Apr 20, 2008 at 7:31 AM, Robert Dober <robert.dober@gmail.com> wrote:
>  > On Sun, Apr 20, 2008 at 3:53 PM, David A. Black <dblack@rubypal.com> wrote:
>  >
>  >  As David I am not sure that instance_eval is safer than eval. As the
>  >  following example shows a save eval can be done by deleting all
>  >  dangerous methods before evalling:
>  >
>  >  module Kernel
>  >   class << self
>  >     methods.each do |m|
>  >       next if /^__/ === m
>  >       Object::send :remove_method, m
>  >     end
>  >   end
>  >   instance_methods.each do |m|
>  >     next if /^__/ === m
>  >     Object::send :remove_method, m
>  >     remove_method m
>  >   end
>  >  end
>  >
>  >
>  >  eval %<system "ls -l">
>  >
>  >  Now this might not often be very useful though as we do not have a
>  >  sandbox or to put it better, it is much work to get out
>  >  of the sandbox again as we have to redefine all methods again (well I
>  >  did not safe them in the first place here). Furthermore my sandbox is
>  >  empty!!!
>  >
>  >  Is there an easy way to do this?
>
>  Well, we could use _why's Freaky Freaky Sandbox:
>  http://code.whytheluckystiff.net/sandbox/
>
Seems to be perfect, now for eval to make sense in the sandbox one has
to build the castles by onself of course :(.
R.




-- 
http://ruby-smalltalk.blogspot.com/

---
Whereof one cannot speak, thereof one must be silent.
Ludwig Wittgenstein