From: Ernest Ellingson <erne@...>
Date: 2001-01-12T23:39:44+09:00
Subject: [ruby-talk:9200] Re: Class from name of class

You could try using Ruby's case method i.e
case className
      when "xxx"
         require 'classx'
      when "yyy"
         require 'classy'
       else
         do something else
end

Using eval is at best a dangerous proposition on a web page.  I can't 
explain why security is different on a GET than a POST however, if I posted 
to your site and my class_name variable had a whole string of commands such 
as delete all the files on your hard drive, or look for certain files, read 
their contents, and write them back to my "browser".   When using eval 
especially on a POST, you have no protection unless you set $SAFE to a 
higher level than 0.
At 23:10 1/12/2001 +0900, you wrote:
>I have a class name in a string, and I want to create an instance of that
>class. Can I do so without using eval? I'm looking for something like
>Java's "Class.forName(className)" or Smalltalk's "Smalltalk classNamed:
>className".
>
>I am trying to build a Web page that can list objects of multiple classes.
>One CGI parameter is the class name. This code violates mod_ruby security
>policy:
>
>     className = cgi['class_name'][0]
>     var = eval "#{className}.instance()" # it's a singleton, thus instance()
>     require className
>
>because both the eval and require operations are insecure. I can get around
>the "require className" limitation by explicitly requiring each class that
>I can possibly need; ugly, but acceptable. (Actually, since all classes are
>derived from a single superclass, I can require the superclass's file
>instead.)
>
>However, how do I create a className instance without using eval?
>
>Another puzzle: there are no complaints about the eval and require the
>first time I load the page by directly typing the CGI parameters in the
>URL. Only when I submit the page's form (which calls the same page via a
>form POST) do I see the security violation error message. What is
>happening?
>
>Thanks in advance for any suggestions.
>
>Jim
>--
>Jim Menard, jimm@io.com, http://www.io.com/~jimm/
>"We've heard that a million monkeys at a million keyboards could produce the
>Complete Works of Shakespeare; now, thanks to the Internet, we know this is
>not true." -- Robert Wilensky, University of California