Is ‘eval’ supposed to be nasty?

by

If you are evaling a string submitted by, or modifiable by the user, this is tantamount to allowing arbitrary code execution. Imagine if the string contained an OS call to rm -rf / or similar. That said, in situations where you know the strings are appropriately constrained, or your Ruby interpreter is sandboxed appropriately, or ideally both, eval can be extraordinarily powerful.

The problem is analogous to SQL injection, if you’re familiar. The solution here is similar to the solution to the injection problem (parameterized queries). That is, if the statements you would like to eval are known to be of a very specific form, and not all of the statement need be submitted by the user, only a few variables, a math expression, or similar, you can take in these small pieces from the user, sanitize them if necessary, then evaluate the safe template statement with the user input plugged in in the appropriate places.

More Related Contents:

  1. When is `eval` in Ruby justified?
  2. How to get the last character of a string in an array [closed]
  3. Compute percentage of cents total
  4. What does ||= (or-equals) mean in Ruby?
  5. How to remove RVM (Ruby Version Manager) from my system
  6. Why use Ruby’s attr_accessor, attr_reader and attr_writer?
  7. Can’t install Ruby under Lion with RVM – GCC issues
  8. How do I download a binary file over HTTP?
  9. How to write to file in Ruby?
  10. Is there an efficient way to perform hundreds of text substitutions in Ruby?
  11. When to use symbols instead of strings in Ruby?
  12. ‘pass parameter by reference’ in Ruby?
  13. Methods in Ruby: objects or not?
  14. How to Uninstall RVM? [duplicate]
  15. sqlite3-ruby install error on Ubuntu
  16. Backslashes in single quoted strings vs. double quoted strings
  17. Is there any wisdom behind “and”, “or” operators in Ruby?
  18. DRY Ruby Initialization with Hash Argument
  19. Exporting an Environment Variable in Ruby
  20. ruby inheritance vs mixins
  21. Library not loaded: /opt/local/lib/libssl.1.0.0.dylib (LoadError)
  22. Understanding the “||” OR operator in If conditionals in Ruby
  23. In Ruby, how does coerce() actually work?
  24. How to check if a Ruby object is a Boolean
  25. Is there a way to remove the BOM from a UTF-8 encoded file?
  26. How can I access a variable defined in a Ruby file I required in IRB?
  27. How to run untrusted Ruby code inside a safe sandbox?
  28. Invalid function in ruby
  29. How to make Sinatra work over HTTPS/SSL?
  30. ERROR: Error installing ffi: ERROR: Failed to build gem native extension

Leave a Comment