Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.c++ > #9121

Re: Evaluating a string as C++ Code

Show all headers | View raw

On Sat, 20 Aug 2011 14:57:21 +0000, Jorgen Grahn wrote:

>> So what answer does your calculator give to system"rm -rf /"?
> 
> More explicitly: eval isn't as useful as you might think, not even in
> interpreted languages, due to the security issues around it.

That depends upon which flavour of eval you're talking about.

Lisp's "eval" is perfectly safe; it takes an s-expression as its argument,
and evaluates that. In practical terms, this means that lists are treated
as function calls, while anything else (including a string) evaluates to
itself.

The problem is with the combined read+eval found in most other languages.
In Lisp, "read" converts a sequence of characters (either from a string or
a file) to a parse tree, while "eval" evaluates the parse tree. It's the
"read" part where security issues occur (usually in the form of injection
attacks). And most languages don't allow the two stages to be separated.

Back to comp.lang.c++ | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Evaluating a string as C++ Code Miro <nickbergeronsemail@gmail.com> - 2011-07-30 09:52 -0700
  Re: Evaluating a string as C++ Code jt@toerring.de (Jens Thoms Toerring) - 2011-07-30 17:40 +0000
    Re: Evaluating a string as C++ Code Miro <nickbergeronsemail@gmail.com> - 2011-08-06 13:55 -0700
      Re: Evaluating a string as C++ Code jt@toerring.de (Jens Thoms Toerring) - 2011-08-07 00:53 +0000
  Re: Evaluating a string as C++ Code Carlo Milanesi <carlo.nospam.milanesi@libero.it> - 2011-07-30 20:08 +0200
    Re: Evaluating a string as C++ Code James Kanze <james.kanze@gmail.com> - 2011-08-07 10:26 -0700
      Re: Evaluating a string as C++ Code Jorgen Grahn <grahn+nntp@snipabacken.se> - 2011-08-11 21:33 +0000
  Re: Evaluating a string as C++ Code Paavo Helde <myfirstname@osa.pri.ee> - 2011-07-30 15:33 -0500
    Re: Evaluating a string as C++ Code BGB <cr88192@hotmail.com> - 2011-07-30 14:45 -0700
  Re: Evaluating a string as C++ Code jacob navia <jacob@spamsink.net> - 2011-08-12 10:25 +0200
    Re: Evaluating a string as C++ Code Juha Nieminen <nospam@thanks.invalid> - 2011-08-12 12:07 +0000
      Re: Evaluating a string as C++ Code jacob navia <jacob@spamsink.net> - 2011-08-12 14:31 +0200
  Re: Evaluating a string as C++ Code Alexei Zakharov <alexeiz@gmail.com> - 2011-08-18 01:53 -0400
    Re: Evaluating a string as C++ Code Juha Nieminen <nospam@thanks.invalid> - 2011-08-18 06:22 +0000
      Re: Evaluating a string as C++ Code Paavo Helde <myfirstname@osa.pri.ee> - 2011-08-18 12:26 -0500
        Re: Evaluating a string as C++ Code Juha Nieminen <nospam@thanks.invalid> - 2011-08-18 18:13 +0000
    Re: Evaluating a string as C++ Code Jorgen Grahn <grahn+nntp@snipabacken.se> - 2011-08-20 14:57 +0000
      Re: Evaluating a string as C++ Code Nobody <nobody@nowhere.com> - 2011-08-20 19:35 +0100
        Re: Evaluating a string as C++ Code Jorgen Grahn <grahn+nntp@snipabacken.se> - 2011-08-21 19:15 +0000
          Re: Evaluating a string as C++ Code Nobody <nobody@nowhere.com> - 2011-08-21 21:50 +0100

csiph-web