5 ms·

a stripped down tcl interpreter is one of the tiniest and less harmful dependendencies you can have nowadays. I do not see a problem with that. And code is da

• kstenerud 6y ago
  Until someone sends serialized code-data like: for i = 1, 1000000 do for j = 1, 1000000 do for k = 1, 1000000 do for l = 1, 1000000 do ... Once you move your publicly injectable data format from declarative to something else, you're in for a world of hurt.
  • nmadden 6y ago
    Tcl has had sandboxed interpreters with resource limits for a long time [1]. You can even remove built-in commands (for/while etc) if you want to. You can limit the language to a purely declarative subset and selectively expose commands and resources as you wish. [1]: https://www.tcl.tk/man/tcl8.5/TclCmd/interp.htm#M46 https://www.tcl.tk/man/tcl8.5/TclCmd/interp.htm#M46
  • dividuum 6y ago
    If you use Lua only for your configuration data, patching the Lua interpreter to limit the CPU time is rather easy: Increment a counter within your lua_State struct here: https://github.com/lua/lua/blob/c33b1728aeb7dfeec4013562660e07d32697aa6b/lvm.c#L1150 https://github.com/lua/lua/blob/c33b1728aeb7dfeec4013562660e..., then abort once you reach a limit.
• CyberDildonics 6y ago
  If you follow the mantra of 'code is data' then you have arbitrary and difficult to debug execution anywhere you have data. Mixing the two intentionally is a blunder of creating software that seems to be repeated over and over, maybe because people keep encouraging it without realizing the cost in non trivial projects.