From: Paul F Fraser <paulf@...2zliving.com>
Date: 2009-08-11T19:23:02+09:00
Subject: Re: Load & Execute Code From a Database

Brian Candler wrote:
> Fabian Streitel wrote:
>   
>> I guess you could sandbox it? There are Ruby sandboxes out there...
>> Still not 100% protection I guess, but better than eval any day...
>>     
>
> _why's sandbox looks to be pretty good, but it requires you to rebuild 
> the ruby interpreter from source with a small patch.
>
> Depending on your application, it may be better to parse some 
> domain-specific language rather than ruby. Look at liquidmarkup.org for 
> an example.
>
> Another solution is to let the user choose between N trusted pieces of 
> code to execute, by storing the name of a method or module in the 
> database. This is pretty safe:
>
> module Snippets
>   module Foo
>     def self.run
>       puts "bah!"
>     end
>   end
> end
>
> modname = "Foo"  # from untrusted source, e.g. db
> Snippets.const_get(modname).run
>   
My question is a little more basic (and dumb)
I have a string containing code from a db.
Forgetting for the moment, security, what do I do with the string to 
have the code available in a running ruby (jruby) application, as I can 
do with a normal load or require?
Thanks,
Paul