From: Jim Menard <jimm@...>
Date: 2001-01-12T23:10:02+09:00
Subject: [ruby-talk:9199] Class from name of class

I have a class name in a string, and I want to create an instance of that
class. Can I do so without using eval? I'm looking for something like
Java's "Class.forName(className)" or Smalltalk's "Smalltalk classNamed:
className".

I am trying to build a Web page that can list objects of multiple classes.
One CGI parameter is the class name. This code violates mod_ruby security
policy:

    className = cgi['class_name'][0]
    var = eval "#{className}.instance()" # it's a singleton, thus instance()
    require className

because both the eval and require operations are insecure. I can get around
the "require className" limitation by explicitly requiring each class that
I can possibly need; ugly, but acceptable. (Actually, since all classes are
derived from a single superclass, I can require the superclass's file
instead.)

However, how do I create a className instance without using eval? 

Another puzzle: there are no complaints about the eval and require the
first time I load the page by directly typing the CGI parameters in the
URL. Only when I submit the page's form (which calls the same page via a
form POST) do I see the security violation error message. What is
happening?

Thanks in advance for any suggestions.

Jim
-- 
Jim Menard, jimm@io.com, http://www.io.com/~jimm/
"We've heard that a million monkeys at a million keyboards could produce the
Complete Works of Shakespeare; now, thanks to the Internet, we know this is
not true." -- Robert Wilensky, University of California