From: theadventmaster Date: 2012-08-16T03:22:27+09:00 Subject: Re: Eval without eval? --bcaec520e9113c764a04c7520275 Content-Type: text/plain; charset=ISO-8859-1 Hi Dipesh, It depends on what you need. Eval is very powerful, but any time you permit arbitrary code execution from the contents of a string, there are safety concerns. If you're looking to execute or apply a specific block of code to particular objects or object instances, consider using blocks and yield. def yieldingMethod ( arg1 ) yield arg1 end yieldingMethod( "Hello, World!" ) do |yieldedValue| prints yieldedValue end If you're calling methods whose names are being dynamically provided, consider Class#send, which allows you to provide a method name and pass parameters to it. You can also call Class#const_get("String") to get a class name at runtime. If you still feel that eval is the appropriate solution to your problem, consider wrapping code blocks in %q{} and %Q{} to make your code easier to read and debug. I am not sure if an equivalent to JavaScript's "new Function( strCode )" exists. In JavaScript, new Function() is a potential optimization and level of additional security over eval, since the same Function object returned from new may be compiled and isn't like to be modified between calls. In Ruby, more is done at runtime, so eval is used very commonly. You may want to read this page on tainted data, for some Ruby security configurations: http://ruby-doc.org/docs/ProgrammingRuby/html/taint.html Thanks, - Alexander Pritchard On Wed, Aug 15, 2012 at 1:48 PM, Brian Candler wrote: > Dipesh Gtm wrote in post #1072447: > > Can anyone explain how "Proc.new{}" (String) could be converted into > > Proc.new{} (Code) without using any form of eval? > > if str == "Proc.new{}" > return Proc.new > end > > ?? > > -- > Posted via http://www.ruby-forum.com/. > > --bcaec520e9113c764a04c7520275 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Hi Dipesh,

It depends on what you need. =A0Eval is very powerful, b= ut any time you permit arbitrary code execution from the contents of a stri= ng, there are safety concerns. =A0If you're looking to execute or apply= a specific block of code to particular objects or object instances, consid= er using blocks and yield.

def=A0 yieldingMethod=A0( arg1 )
=A0 =A0 yield arg1
end
<= div>
yieldingMethod( "Hello, World!" ) do |y= ieldedValue|
end

If you're calling = methods whose names are being dynamically provided, consider Class#send, wh= ich allows you to provide a method name and pass parameters to it.

You can also call Class#const_get("String") t= o get a class name at runtime.

If you still feel t= hat eval is the appropriate solution to your problem, consider wrapping cod= e blocks in %q{} and %Q{} to make your code easier to read and debug.

I am not sure if an equivalent to JavaScript's &quo= t;new Function( strCode )" exists. =A0In JavaScript, new Function() is= a potential optimization and level of additional security over eval, since= the same Function object returned from new may be compiled and isn't l= ike to be modified between calls. =A0In Ruby, more is done at runtime, so e= val is used very commonly.

You may want to read this page on tainted data, for som= e Ruby security configurations: =A0http://ruby-doc.org/docs/ProgrammingRuby/html/= taint.html


Thanks,
- Alexander Pritchard<= /div>

On Wed, Aug 15, 2012 at= 1:48 PM, Brian Candler <lists@ruby-forum.com> wrote:
Dipesh Gtm wrote in post #1072447:
> Can anyone explain how "Proc.new{}" (Strin= g) could be converted into
> Proc.new{} (Code) without using any form of eval?

if str =3D=3D "Proc.new{}"
=A0 return Proc.new
end

??

--
Posted via http://= www.ruby-forum.com/.


--bcaec520e9113c764a04c7520275--