Very simple rules implementation

[oniric]

Hi Monks, I would like to implement a system where users can enter code in a configuration file (in the form of if/else) with a single parameter (like $_). Something like that

if($_ > 10){return 1}
elsif($_>3){return 2 } 
else {return 1 }

Then this code should be called when needed and maybe 'eval'ed as a sub reference. I'm not totally satisfied by this solution however, first because of security problems, I don't want my user to possibly launch system programs (ok, they won't, but they could..) second because I think eval could take some time and slow down my system. What do you think? I'm seeking your wisdom.

[Eliya]

As for eval slowing down your system, don't worry — unless you're eval'ing those config snippets millions of times... (on my system, the given piece of code wrapped in a sub can be eval'ed and executed roughly 50000 times per second).

The security worries, OTOH, are justified, presuming you can't trust your users, and the code isn't being run under their own user ID anyway (in which case I wouldn't worry too much...)   You might want to look into Safe to restrict the opcodes that can be used.

[SuicideJunkie]

You can't trust your users, and you shouldn't even trust yourself.

Without protection, one little typo or context failure and you're overwriting your backups with the corrupt version, or perhaps deleting your entire harddrive.

_{Yeah, I really should have set the physical write-protect on that final backup...}

[Anonymous Monk]

See Safe, Safe::World, the default rules prohibit system commands

#!/usr/bin/perl --
use Safe;
my $safe = Safe->new;
for my $val ( qw/ bye hi / ){
    local $_ = $val;
    my $ret = $safe->reval(q{
        return 1 if /bye/;
        return 0 if /hi/;
    });
    print "$val => $ret\n";
}
$safe->reval(q{ system(); }) or die $@;
__END__
bye => 1
hi => 0
'system' trapped by operation mask at (eval 9) line 1.

See also (i'm guessing) workflow implementation with perl

[oniric]

This seems reasonable, thank you! Do you think my choice of 'eval' for this task could be changed with something even simpler in my case?