7 ms·
because eval is the real source of the problem
by devgutt 13y ago
because eval is the real source of the problem
- Dylan16807 13y agoWould you remove the ability to load libraries, too? Because that's as dangerous as eval when it comes to purposely writing code to run external commands. The ability of a programming language to run code is not the cause of the problem, it's having domain-breaking misleading functions like a string replacer that can compile and execute.
- devgutt 13y agoyeah because libraries, which is available for scrutiny of a community (and you), is the same as a function that can run any arbitrary code in your program at runtime.
- Dylan16807 13y agoIf you can load libraries at runtime, you can load a secret malicious library, or replace a standard library with arbitrary code before triggering the loading. So would you remove that ability to avoid its exploitation potential by malware?