4 ms·
Security. You can parse a reader literal without evaluating the resulting data structure. If you're just reading and evaluating, you might find someone injectin
by weavejester 15y ago
Security. You can parse a reader literal without evaluating the resulting data structure. If you're just reading and evaluating, you might find someone injecting some malicious code in there. By using reader literals, you can include custom types like dates or UUIDs or whatever, without needing to trust the entity sending you the data.
- chc 15y agoOh, I think I get it now: The difference is that the data part of a reader literal has a fixed form, while the argument to a function could be arbitrary code. Is that right?
- Tuna-Fish 15y agoCorrect.
- nickik 15y agoYes and another thing is that when you want to use Clojure Data together with other languages. You cant calls (mydate "15.11.2000") to a python runtime, to understand it you would need a clojure runtime. When you send #mydate "15.11.2000" you only need a clojure reader. What to do with the date literals can be handled in a python function. The reader is a rather simple peace of code.