Hacker News new | ask | show | jobs
by d33 1327 days ago
I like the idea, but if it was interpreted directly, that would be a security nightmare unless we also had something like Python's ast.literal_eval(). Which makes us come back to JSON-like outputs because we need some form of serialization anyway, I guess.
1 comments

Of course there could be some tweaks like a scoped eval to prevent stomping on the script's variables, but it's really not very hard for a C program to escape shell variables correctly and safely.

You could have an eval that only read variables, but trusting a program to only return variables is a really low bar; it's very hard to mess that up.