3 ms·
This may be application-specific, but I might worry about security if my configuration files support arbitrary closures.
by gjstein 7y ago
This may be application-specific, but I might worry about security if my configuration files support arbitrary closures.
- rco8786 7y agoAny more so than the rest of your code?
- dragonwriter 7y agoConfig files are typically written updated by non-developers and often go through a less rigorous release process, so having a less-complex and dangerous, even if less-capable, language can be desirable.
- rco8786 7y agoAh, that's not been my experience - but I can understand that if non-developers are the ones making the changes
- amelius 7y agoIf an attacker has write access to your configuration files, isn't all lost already?