In terms of an application that's about affording its end-uses the ability to add, view, and manipulate their own data (like Podio, Trello, Redbooth, Asana, et cetera), I'm wondering how it can be designed such that it also affords them the ability to add code-as-data to the app and have the app be a function of that user-added-code as well as its original, base code.

I wonder, in particular, how to do this with a web app; so, in a JavaScript context. I've seen a number of assertions that eval() is "evil", but I can't think of any other way to take code from a user. And, even with eval(), it's unclear to me how to how to structure the app such that it can incorporate that user-supplied code back into itself. Additionally, should there be a core of the app that's never changed to keep the user from nuking the system —TiddlyWiki (something that seems to exemplify the quality I've in mind) mentions a "microkernel", a "boot script", and module system, though I don't quite get how it all works.

From what I've looked at thus far, I've seen mention of DSLs a lot. How's that fit in? And some stuff about vulnerability to malicious injection and the need to sandbox (or something) the user code. How's that work?

Spreadsheet apps also come to mind as doing what I'm asking about. With many of 'em, one can write their own functions that tie into core parts of the app and that stuff is written in cells as data.

  • It is unclear to me how all of this relates to homoiconicity. Can you explain that in a little more detail? In particular, you talk about JavaScript, which is not homoiconic. – Jörg W Mittag Feb 7 at 7:49

Adding code as data and adding text as code and calling eval on it are two different things. Calling eval directly on text is a no-no because it opens your program to be susceptible to injection attacks.

However, it is possible to protect your code using a sandbox library such as YUI3 so that your framework code remains in tact and cannot be overridden. I would strongly recommend that you use a library for this, as it probably isn't something you want to mess up, in the interests of your program integrity. However, all a sandbox is essentially doing is putting your functions into a higher scope so they cannot be overridden or even called without being a call directly coming from the very same sandbox (so your own code).

It would also probably be in your best interests to use a sandbox to run code added by the user as well. If you want to be more sophisticated still, there are libraries like Esprima which can also tell you if the code is valid code before you attempt to make it available to run. This isn't for security measures so much as simply preventing your browser from attempting to run code which is broken.

So in conclusion: eval is evil. Sandboxing is less evil.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.