4 ms·
eval is bad, but there are better alternatives which don't involve unsafe string concatenation. OCaml had (for a while) a nice system for constructing ASTs, eg
by rwmj 4y ago
eval is bad, but there are better alternatives which don't involve unsafe string concatenation. OCaml had (for a while) a nice system for constructing ASTs, eg:
let ast = <:expr< 1 + 2 >>
would be the way to write the AST:
+
/ \
1 2
and you could compose those in various ways, eg:
let ast2 = <:expr< $ast$ + 3 >>
Of course it was all safe at compile time. The main issue with it was it was quite complicated and terribly badly documented.
- AstralStorm 4y agoThe whole idea behind eval is to provide textual input. Requiring an AST as input breaks the whole idea - you're just writing code directly in an awkward format.
- rwmj 4y agoYou're avoiding a whole can of exploits: eval 'print ("hello, $some_user_input")'
- dannymi 4y agoeval comes from Lisp, and there, it's not textual input. You give it a quoted form (i.e. an AST) and an environment and it evaluates the form in that environment. > (eval '(display (+ 5 6)) (interaction-environment)) 11