Re:Is eval evil? Just-in-time compiling
by nine_k on Monday November 19, 2018 @01:09PM
(#18488327)
I suppose the biggest problem with `eval` is not getting uncontrolled user data into it.
A kind of filter shown in the matthewaveryusa's reply may be secure, but it's pretty limiting, and may happen to be too limiting for a particular purpose.
It would be great if the AST of the expression to be evaluated could be checked. That is, `eval` could be two pieces: "compile" and "execute" phases; this is how it works in Python.
Another tool could be a type system that marks user input as "tainted" and helps you track where you're using user input in any capacity. But languages featuring `eval` usually lack such a type system.
A kind of filter shown in the matthewaveryusa's reply may be secure, but it's pretty limiting, and may happen to be too limiting for a particular purpose.
It would be great if the AST of the expression to be evaluated could be checked. That is, `eval` could be two pieces: "compile" and "execute" phases; this is how it works in Python.
Another tool could be a type system that marks user input as "tainted" and helps you track where you're using user input in any capacity. But languages featuring `eval` usually lack such a type system.