From: Dave Thomas <Dave@...>
Date: 2002-04-05T07:51:39+09:00
Subject: Re: Is eval a code/design smell?

Sean Middleditch <elanthis@awesomeplay.com> writes:

> I know I would.  To me, that is indeed a language flaw.  There
> should be methods that don't open up the security holes of eval()
> for finding/setting attributes of an object.  Your specific need for
> no initialize() still seems weird to me, but if it is necessary, and
> the language restricts you from doing it, then either the language
> is flawed or you are using the wrong langauge for the task.

Seems to me that providing methods to set instance variables in an
object is a potential security flaw in it's own right:

   bank.grab_iv("account_no")

   backup_process.set_iv(:backup_cmd, "rm -rf")


I use various flavors of eval all the time--one of the things I like
about Ruby is the ability to extend it. It would be nice to have a
macro-facility that eliminated the need for some of this, but I can't
imagine ever producing a language that had _all_ the features that
anyone could want, so eval and friends are a useful thing to have in
your back pocket.


Dave