| You could. But that has downsides also: 1. imposing CPU limits incurs an inherent CPU overhead and code complexity. 2. if those limits are hit, you can't tell whether the code just ran too long or whether it was in an infinite loop. So now if we fully evaluate the options, the choice is between: 1. A purely data language like JSON: simple to implement, fast to parse, decoder can skip over parts it doesn't want, etc. 2. A Turing-complete data format: have to implement sandboxing and CPU limits (both far trickier security attack surfaces), have configure CPU limits, when CPU limits are exceeded the user doesn't know whether the code was in an infinite loop or not, maybe have to re-configure CPU limits. Sure, sometimes all the work involved in (2) is worth it, that's why we have JavaScript in web browsers after all. But a Turing-complete version of JSON would never have taken off like JSON did for APIs, because it would be far more difficult and perilous to implement. |
Abstractions exist for a reason -- this is analogous to source/channel coding separation or internet layers. They don't have to be that way, but are there for a reason.
Someone could change my opinion, though. Provide me a data format which proves certain things about it's behavior and that would be a nice counterexample.