From: Robert Klemme <shortcutter@...>
Date: 2013-07-27T21:00:16+09:00
Subject: Re: Calculate input - numbers

--047d7bb03e6a8bea1504e27d008d
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

On Sat, Jul 27, 2013 at 1:44 PM, Marc Heiler <lists@ruby-forum.com> wrote:

> Hi
>
> user_input =3D $stdin.gets.chomp
>
> Now the user types:
>
> "5 + 5"
>
> As string (without the quotes).
>
> user_input is now a string object containing "5 + 5"
>
> I would like to give back the result of the operation, which should be
> 10.
>
> Right now I use eval() and it works, but I am wondering if there is a
> better alternative for it? How does IRB solve this?
>

It probably also uses eval. In your case it's a security risk because
someone can enter "system('rm', '-rf', '$HOME')" and you'll see what
happens with that in eval.

The proper way is to use a parser for mathematical expressions.  That would
verify that the expression is OK and you could also use the AST to evaluate
it.  In Ruby you might actually be able to write such a parser with an
arcane regular expression because Ruby's Oniguruma is capable of matching
non regular languages (i.e. nested structures with matching brackets).  But
that'll look horrible=B4, I guess. :-)

Cheers

robert


--=20
remember.guy do |as, often| as.you_can - without end
http://blog.rubybestpractices.com/

--047d7bb03e6a8bea1504e27d008d
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><br><div class=3D"gmail_extra"><br><br><div class=3D"gmail=
_quote">On Sat, Jul 27, 2013 at 1:44 PM, Marc Heiler <span dir=3D"ltr">&lt;=
<a href=3D"mailto:lists@ruby-forum.com" target=3D"_blank">lists@ruby-forum.=
com</a>&gt;</span> wrote:<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">Hi<br>
<br>
user_input =3D $stdin.gets.chomp<br>
<br>
Now the user types:<br>
<br>
&quot;5 + 5&quot;<br>
<br>
As string (without the quotes).<br>
<br>
user_input is now a string object containing &quot;5 + 5&quot;<br>
<br>
I would like to give back the result of the operation, which should be<br>
10.<br>
<br>
Right now I use eval() and it works, but I am wondering if there is a<br>
better alternative for it? How does IRB solve this?<br></blockquote><div><b=
r></div><div>It probably also uses eval. In your case it&#39;s a security r=
isk because someone can enter &quot;system(&#39;rm&#39;, &#39;-rf&#39;, &#3=
9;$HOME&#39;)&quot; and you&#39;ll see what happens with that in eval.</div=
>
<div><br></div><div>The proper way is to use a parser for mathematical expr=
essions. =A0That would verify that the expression is OK and you could also =
use the AST to evaluate it. =A0In Ruby you might actually be able to write =
such a parser with an arcane regular expression because Ruby&#39;s Onigurum=
a is capable of matching non regular languages (i.e. nested structures with=
 matching brackets). =A0But that&#39;ll look horrible=B4, I guess. :-)</div=
>
<div><br></div><div>Cheers</div><div><br></div><div>robert</div></div><br c=
lear=3D"all"><div><br></div>-- <br>remember.guy do |as, often| as.you_can -=
 without end<br><a href=3D"http://blog.rubybestpractices.com/">http://blog.=
rubybestpractices.com/</a>
</div></div>

--047d7bb03e6a8bea1504e27d008d--