From: "Ara.T.Howard" <ahoward@...>
Date: 2004-05-11T02:53:55+09:00
Subject: Re: safe eval?

On Tue, 11 May 2004, ts wrote:

> >>>>> "A" == Ara T Howard <Ara.T.Howard@noaa.gov> writes:
> 
> A> 1) eval
> 
> [...]
> 
> A>  2) code generation using ruby to evaluate (this protects against evil
> A>  evals) 
> 
>  If you really think that you are protected against the evil eval then just
>  try 
> 
> A>     request = 'a < 42 and b == true'
> 
>        request = '(a < 42 && b == true; %x{ls})'
> 
>  then replace ls with what you want ...
> 
>  Use $SAFE = 4 in a new thread

and this does protect against modifying globals.... hmmm.  simple (could be
done today) and safe...  sounds better than writing a parser/scanner...


-a
-- 
===============================================================================
| EMAIL   :: Ara [dot] T [dot] Howard [at] noaa [dot] gov
| PHONE   :: 303.497.6469
| ADDRESS :: E/GC2 325 Broadway, Boulder, CO 80305-3328
| URL     :: http://www.ngdc.noaa.gov/stp/
| TRY     :: for l in ruby perl;do $l -e "print \"\x3a\x2d\x29\x0a\"";done 
===============================================================================