3 ms·
eval("dangerous python code here") As I pointed out, it is a problem in any language that has eval. The way you deal with it, is you never eval anything untrus
by pavelludiq 14y ago
eval("dangerous python code here")
As I pointed out, it is a problem in any language that has eval. The way you deal with it, is you never eval anything untrusted, which is actually extremely easy to do. I don't believe I've ever used eval ever.
In CL specifically, because the reader can evaluate code as well, every time you use the read function, you should know these two things: 1) never use it for user input. 2) bind read-eval to nil. You'll be fine, or more accurately, no worse than anybody else :)
On the other hand macros, and having a json style serialization format that is much more powerful and actually extensible is a big plus :)
- sdkmvx 14y agoIs it actually dangerous to use read for user input? (defun read-data () (let ((data (let ((*read-eval* 'nil)) (read)))) (mapcar (lambda (x) (format 't "~a: ~a~%" (car x) (cdr x))) data))) Then I can (read-data) (("a" . 1) ("b" . 2) ("c" . (funcall (lambda () (princ "I ran code!"))))) And the following will print. a: 1 b: 2 c: (FUNCALL (LAMBDA () (PRINC I ran code!))) But of course unless I eval the code, arbitrary code will not run (assuming I haven't forgotten some aspect of the reader).