Most modern languages (which are somehow interpreted) have some kind of eval function. Such a function executes arbitrary language code, most of the time passed as the main argument as a string (different languages may add more features to the eval function).
I understand users should not be allowed to execute this function (edit i.e. take directly or indirectly arbitrary input from an arbitrary user to be passed to
eval), especially with server-side software, since they could force the process to execute malicious code. In that way, tutorials and communities tell us to not use eval. However, there are many times where eval is useful and used:
- Custom access rules to software elements (IIRC OpenERP has an object
ir.rulewhich can use dynamic python code).
- Custom calculations and/or criteria (OpenERP has fields like that to allow custom code calculations).
- OpenERP report parsers (yes I know I'm freaking you out with OpenERP stuff... but it is the main example I have).
- Coding spell effects in some RPG games.
So they have a good use, as long as they are used properly. The main advantage is that the feature allows admins to write custom code without having to create more files and include them (although most frameworks using eval features have also a way to specify a file, module, package, ... to read from).
However, eval is evil in the popular culture. Stuff like breaking into your system comes to mind.
However, there are other functions which could be harmful if somehow accessed by users: unlink, read, write (file semantics), memory allocation and pointer arithmetic, database model access (even if not considering SQL-injectable cases).
So, basically, most of the time when any code is not written properly or not watched properly (resources, users, environments, ...), the code is evil and can lead even to economic impact.
But there's something special with
eval functions (regardless of the language).
Question: Is there any historical fact for this fear becoming part of the popular culture, instead of giving the same attention to the other possibly dangerous features?
eval, it has an internal function called
safe_evalthat is prepares the environment to prevent the code from doing dangerous things. Bugs have been found, though, since Python is a quite flexible language, and therefore hard to control.