On Fri, Apr 05, 2002 at 04:13:34PM +0900, Harry Ohlsen wrote:
> Sean Middleditch <elanthis / awesomeplay.com> wrote in message news:<1017972221.1273.22.camel / stargrazer>...
> > On Thu, 2002-04-04 at 20:33, Harry Ohlsen wrote:
> > > > I know I would.  To me, that is indeed a language flaw.  There should be
> > > I'm not quite sure what security holes you imagine can be opened up
> > > by a piece of code like ...
> > > 
> > >    obj.instance_eval "@{name} = value"
> > 
> > Depends.  Where does name and value come from?  Like mentioned in other
> > threads, clever programmers can pull some clever tricks.
> 
> Fair point. I guess I'm assuming that, since both the name and the
> value are coming from XML that was generated by the same module
> there's no latitude for it to be corrupted.  I guess, though, that
> it's possible the XML could come from somewhere else, like the
> serialised XML could be written to a file, edited then deserialised
> again.

Ya.  Depending on your exact situation, eval() could be safe - but of
course, that is likely the exception, not the rule.

> 
> > It would be much cleaner to have something like:
> > 
> > obj.set_member(name, value)
> 
> Agreed.  It would be nice if the language provided that.
> 
> > > The point is that, since you're going to overwrite every single
> > > attribute with its value from the XML then what does calling
> > > initialize achieve?  On top of that, there's a major issue to
> > > do with working out what values to pass to initialize. They
> > > may not simply be the attributes of the class.
> > 
> > OK, I'm not following - what is then the difference with just not
> > defining an initializor?  
> 
> For some reason everyone seems to assume that the classes one is
> serialising only exist to be serialised!

Ah, that's what I was thinking.  ^,^

> 
> Who's to say that the class doesn't already exist, has an initialize
> and I've simply decided that I would like to turn an instance into
> XML?  This is precisely my situation at the moment, which is why I
> got involved in the discussion with Chris.

Gotcha.

> 
> > Ya.  I would think a simple C extension could be written to add the
> > functionality discussed.  Why one isn't standard is beyond me; I'm
> > assuming there's some gotcha with the Ruby runtime I don't know about.
> 
> I assume that's precisely what the new allocate method is, but I
> haven't looked, either.

Sean Etc.