From: Sean Middleditch <elanthis@...>
Date: 2002-04-07T02:07:04+09:00
Subject: Re: Is eval a code/design smell?

On Sat, 2002-04-06 at 06:15, Tobias Reif wrote:
> Sean Middleditch wrote:
> 
> 
> > If eval() is running faster than your schema->lib functions, then I
> > would simply say your functions are too slow.  ^,^
> 
> 
> ?? I'm not using eval. I'm saving the generated lib as a file; then each 
> time I use it, require 'it'.
> 
>   Sure this (b) is faster than generating the lib each time (a); don't 
> you think so?

Ah, I see.  Yes, Ruby doesn't let you get around that too easily, since
you can't (so far as I know) load pre-parsed bytecode of any form.

> 
> a) Jelly parsing the XSD; extracting documentation, generating modules, 
> generating classes, generating methods, etc.
> 
> versus
> 
> b) Ruby loading the lib
> 
> 
> > I still don't see why Ruby shouldn't provide methods for quickly,
> > easily, and powerfully constructing classes at runtime with sending
> > untrustable content to the parsing engine. 
> 
> 
> You mean "without"?

Ya.  Oops.

> 
> Anyways: perhaps this would be a nice feature. Any syntax ideas?
> 
> I mean: keep eval, but offer something safer (more restricted) for 
> "evaling" Ruby code. (?)
> 
> > Because, I can just imagine
> > someone downloading a schema from the web that has an embedded
> > kernel.system('rm -rf $HOME/') -
> 
> 
> This would not matter, AFAICS. Depending on where it would be embedded, 
> it would end up in RDoc, doing no harm.
> 
> If you want to deal with downloaded files containing rm -rf, then I 
> don't see away other than reading each and every line of code that you 
> run, with human eyes.

Well, it would depend what kind of objects you are storing.  If you are
storing every kind of object imaginable, then yes, they might as well
download a precompiled library and then be surprised when it had such a
'feature.'

> 
> 1. Why would someone embed 'rm -rf into an XSD?
> 2. It would be much more likely to cause harm if it were embedded in a 
> Ruby file ;)

Sorry, again, I was going from the assumption you were eval()'ing parts
of the files.

> 
> > if you provide a schema in non-code
> > format,
> 
> 
> you mean non- Ruby code?

Ya.

> 
> > that can be parsed in a safe manner that checks for this stuff.
> 
> 
> Could I insert some safe level statement into the generated libs?
> 
> 
> I mean, if you're really concerened about security, then I welcome 
> practical help.

Safe levels wouldn't help, that I know of - the loaded lib would be
fully trusted, wouldn't it?

> 
> 
> > If you need to dump arbitrary objects (that might be valid to have a
> > command to delete your home directory) it would probably be cleaner
> > anyways to be able to serialize the bytecode/tree nodes, and store
> > those;
> 
> 
> Why? Then any unsecure/dangerous code would be obfuscated. This is 
> contradicory to what you want.

That's a good point, actually.  ^,^

> 
> I want to keep the generated libs readable, so people can 
> read/modify/check them before running them).
> 
> > it would load even faster,
> 
> 
> You mean everyone should provide their libs as bytecode only? Then we're 
> back to pre open source days.

Na, I was saying that how you were concerned with speed, pre-parsed
loads even faster.  Besides, just becuase it's distributed in compiled
form doesn't mean it can't be distributed in source form, as well. 
Heck, I almost never compile source code when installing software - I
jsut apt-get it into place.  But I know if I need the source (which of
course happens every now and again) I can get it.

> 
> Tobi
> 
> 
> -- 
> Neither simple nor complex matters are to be complicated.
>