From: harryo@... (Harry Ohlsen) Date: 2002-04-05T16:13:34+09:00 Subject: Re: Is eval a code/design smell? Sean Middleditch wrote in message news:<1017972221.1273.22.camel@stargrazer>... > On Thu, 2002-04-04 at 20:33, Harry Ohlsen wrote: > > > I know I would. To me, that is indeed a language flaw. There should be > > I'm not quite sure what security holes you imagine can be opened up > > by a piece of code like ... > > > > obj.instance_eval "@{name} = value" > > Depends. Where does name and value come from? Like mentioned in other > threads, clever programmers can pull some clever tricks. Fair point. I guess I'm assuming that, since both the name and the value are coming from XML that was generated by the same module there's no latitude for it to be corrupted. I guess, though, that it's possible the XML could come from somewhere else, like the serialised XML could be written to a file, edited then deserialised again. > It would be much cleaner to have something like: > > obj.set_member(name, value) Agreed. It would be nice if the language provided that. > > The point is that, since you're going to overwrite every single > > attribute with its value from the XML then what does calling > > initialize achieve? On top of that, there's a major issue to > > do with working out what values to pass to initialize. They > > may not simply be the attributes of the class. > > OK, I'm not following - what is then the difference with just not > defining an initializor? For some reason everyone seems to assume that the classes one is serialising only exist to be serialised! Who's to say that the class doesn't already exist, has an initialize and I've simply decided that I would like to turn an instance into XML? This is precisely my situation at the moment, which is why I got involved in the discussion with Chris. > Ya. I would think a simple C extension could be written to add the > functionality discussed. Why one isn't standard is beyond me; I'm > assuming there's some gotcha with the Ruby runtime I don't know about. I assume that's precisely what the new allocate method is, but I haven't looked, either.