4 ms·
Out of curiosity, why is it ever a good idea to add a command to execute arbitrary strings in the same space as the user? eval() has been the same source of hea
by madrox 8y ago
Out of curiosity, why is it ever a good idea to add a command to execute arbitrary strings in the same space as the user? eval() has been the same source of headaches in javascript over the years.
I believe WoW uses it primarily to let the player make macros, which is a legit use, but using something like RunScript to do it seems lazy.
- bcoates 8y agoeval is by far the easiest way to run arbitrary code, but you can write eval yourself in any fully-general programming language. It doesn't actually give attackers any additional power. This isn't the eval attack where you accidentally pass attacker-controlled inputs into eval because of an escaping problem or something, the sole purpose of /run is to allow users to run arbitrary Lua in the UI
- tinus_hn 8y agoJavaScript needs a way to load a script from another script. That functionality is equivalent to eval(), whichever way you build it.
- matheusmoreira 8y agoMetaprogramming. It's possible to generate source code and then evaluate it. For example: one can write a parser generator that compiles a grammar to a Javascript function definition that parses that grammar, which can then be evaluated from within Javascript in order to create the custom function.