Re: execute a string as a function

in reply to execute a string as a function

Definitely dispatch .. avoids the Bobby Tables Problem, which has many manifestations. You should also preface this with an explicit test to verify that a key does exist in the dispatch table, e.g.:

die "No key for '$foo!'" unless exists($dispatch->{$foo});

... making sure, of course, that this message (specifically, $foo), in un-sanitized form cannot by any means make its way into any user-delivered output, where it could conceivably be a vector for script-injection. The message should appear only in unpublished log-files (STDERR).

As just one of its many advantages, this technique avoids the overhead of “compiling at runtime,” and it expressly indicates the full extent of what you, the designer, intended for the software to do in every case, “and here are all the cases.” With a mere glance at the source code, anyone can plainly see what the software is to do given any possible input, malicious or otherwise, and can be certain that this is what will occur.

Comment on Re: execute a string as a function

Replies are listed 'Best First'.
Re^2: execute a string as a function by bioinformatics (Friar) on Aug 07, 2013 at 12:43 UTC
This script is dealing with (if I'm guessing correctly) processing of biological sequences. It's doubtful that script injection would be a concern here... Bioinformatics	[reply]
Re^3: execute a string as a function by Anonymous Monk on Aug 07, 2013 at 15:02 UTC
We could be looking at the first chemical to electronic host-jumping virus! Best to be safe.	[reply]

In Section Seekers of Perl Wisdom