So this doesn't seem to be documented anywhere but the heist language supports ruby string interpolation. You might remove all the builtin functions that do bad stuff (load?) and then think you have a safe sandbox. However, the string interpolation allows the sandbox to be broken.
require 'heist'
scheme = Heist::Runtime.new
scheme.eval('"#{puts :foo}"')
I'm not sure if this ruby string interpolation syntax is done on purpose or not because it seems a bit weird to embed a different language for string interpolation. Possibly this was a lazy way of implementing \ escapes.
|
@value = Kernel.eval(text_value) |
Anyway, I think it should be documented that the language supports this feature.
So this doesn't seem to be documented anywhere but the heist language supports ruby string interpolation. You might remove all the builtin functions that do bad stuff (load?) and then think you have a safe sandbox. However, the string interpolation allows the sandbox to be broken.
I'm not sure if this ruby string interpolation syntax is done on purpose or not because it seems a bit weird to embed a different language for string interpolation. Possibly this was a lazy way of implementing \ escapes.
heist/lib/heist/parser/nodes.rb
Line 134 in 3f372b2
Anyway, I think it should be documented that the language supports this feature.