5 ms·
Rather than trying to sanitize the input to 'eval', why not just write a separate expression evaluator? Then you can know for sure that there's no way to craft
by ScottBurson 8y ago
Rather than trying to sanitize the input to 'eval', why not just write a separate expression evaluator? Then you can know for sure that there's no way to craft an input that causes an arbitrary function call, because your evaluator has no way to make an arbitrary function call. Also, you can define whatever operators you like.
This use case doesn't seem to me to be one that's likely to arise often.
- convolvatron 8y agoif you had an evaluator which collected up all the mutations to the global state as a batched commit ala software transactional memory, imagine all the fun games you could play
- fjsolwmv 8y agoEverything old is new again. http://search.cpan.org/search?mode=module&query=Safe http://search.cpan.org/search?mode=module&query=Safe