3 ms·
My one fear with a lisp-based framework would be code-injection stuff, unless janet has some way of freezing the source in production. You could do a lot of dam
by sam0x17 4y ago
My one fear with a lisp-based framework would be code-injection stuff, unless janet has some way of freezing the source in production. You could do a lot of damage if you suddenly realize you can inject code via a request payload on some server running a lisp-based framework.
Really cool though!
- swlkr 4y agoI’ve never thought about this, that’s interesting, would escaping or coercing params help with this?
- beders 4y agoBut where's the eval? Unlike certain other languages (cough Java python), reading quoted s-exps has no side-effect.
- s-lambert 4y agoUnless the code you've written uses eval and passes user-provided data to the eval function, there's no way to inject code. JavaScript also has an eval function that and code injection is not a worry at run-time for Node projects unless they're using eval() as well.