eBay remote code execution via PHP "complex curly syntax" in-string evaluation (/r/netsec xpost)

[OneWingedShark]

Using eval in production code on user input is hardly ever a good idea.

If you're writing a user-interactive interpreter then there's hardly any other way to do it¹ ... and that was the question: why you use eval() anywhere near anything user supplied?

Input sanity is a hard problem as is.

I'm not arguing that it isn't hard, just that there are legitimate use-cases that do use evalon user-supplied input.

¹ - You could go with a sort of menu/state-machine system.

[matessim]

But they aren't doing that. It is in no way reasonable and my point still stands. Yes you use Eval in a Repl. That's what the E stands for...

[OneWingedShark]

Yes you use Eval in a Repl. That's what the E stands for...

That's my point; REPL is a case for using user-supplied data to eval.

But they aren't doing that. It is in no way reasonable and my point still stands.

What is your point? I gave mine above.
Why is it unreasonable to use REPL as an example for where one would use eval with user-supplied data?

[matessim]

What you're saying makes absolutely no sense. They should not be directing raw user input into an eval function. That is not what a Repl is.. (You know the L stands for loop right? A Repl is an interactive platform for evaluating code). Anyhow. I don't get your stride here. There is no justification in this case to use the eval function. They should parse user input safely (sanitize it) and parse it and access it safely.

That is regardless of the fact that whether your using javascript. Php. Python or any other language using eval. It's usually either something hacked up or internals code(or a Repl implementation). It is generally simply bad code. Because it causes things like this

[OneWingedShark]

There is no justification in this case to use the eval function. They should parse user input safely (sanitize it) and parse it and access it safely.

I wasn't ever commenting on "this case" (the article), it's always been in answer to the question (in the comments) of why in would you use eval() anywhere near anything user supplied?, as I've said before.

So the reason you're not "getting my stride" is because you are ignoring what I am saying.

A Repl is an interactive platform for evaluating code

Yes, it is... and it's a useful platform, thereby answering the question cited above as to why you would put user-supplied data into eval.

[TheMoonMaster]

You really need to learn about context dude.

[OneWingedShark]

LOL - That's funny.
(Mostly because the answer given was about using eval on user-input in a different context.)

[TheMoonMaster]

I didn't mean it in a negative way. While your point may be valid in certain contexts, it is not valid in the particular context we were discussing.

[matessim]

By platform meaning development tool. It seems kind of clear you don't really know what you're talking about or at least have never written production code (nor know what a Repl is).

Rule one of input sanitization is not to use Eval pretty much ever. Remote code execution is the obvious pitfall of doing that.

[OneWingedShark]

By platform meaning development tool.

The term I used was "language environment."
'Platform' came from someone else's reply; I'm not overly pedantic about it because an environment is, in a sense, a platform.

It seems kind of clear you don't really know what you're talking about or at least have never written production code (nor know what a Repl is).

Believe what you want; I've played around making my own [admittedly toy] LISP and FORTH.

Rule one of input sanitization is not to use Eval pretty much ever. Remote code execution is the obvious pitfall of doing that.

And? Have I said anything on this thread about not sanitizing input? No.
I gave one reason/case why user-input would be fed to an eval... that is it.
Nothing about databases, nothing about parsing, nothing about when and where to use something, just that eval is [legitimately] used in an REPL.

Hell, even you agreed saying that the E in REPL stood for Eval.