From: Kent Dahl <kentda@...>
Date: 2002-03-28T04:29:57+09:00
Subject: Re: Variable variables in Ruby?

Jonas Delfs wrote:
> Thanks - but I know this one. I want to do it without eval() for security
> reasons (and maybe speed?). The var with the variable-name is comming from
> the user.

Check one for security would be to see that the given variable name
actually exists:

irb(main):006:0> $_fuddyduddy = "Arschloch!"
"Arschloch!"
irb(main):007:0> a = "fuddyduddy"
"fuddyduddy"
irb(main):008:0> if global_variables.include?("$_"+a) then puts
eval("$_#{a}") end
Arschloch!
nil

Failing to see how any valid global variable name could spawn dangerous
code that you wouldn't want to put in an eval, I don't begin mucking
about with RegExp matching...


-- 
<[ Kent Dahl ]>================<[ http://www.stud.ntnu.no/~kentda/ ]>
  )__(stud.techn.;  ind. econ & management: computer technology)__( 
 /"Opinions expressed are mine and not those of my Employer,      "\
( "the University, my girlfriend, stray cats, banana fruitflies,  " )
 \"nor the frontal lobe of my left cerebral hemisphere.           "/