Disable undocumented #= reader macro to prevent unsafe code injection?

2013-04-09 Thread rebcabin
Hello -- I would like to use Clojure to build a safe code-remoting application for query injection (moving queries closer to the data for affinity and privacy). One alternative for this application is to read Clojure code from strings WITHOUT evaluating it, then analyze the presented code and

Re: Disable undocumented #= reader macro to prevent unsafe code injection?

2013-04-09 Thread David Powell
On Tue, Apr 9, 2013 at 6:03 PM, rebcabin bc.beck...@gmail.com wrote: Hello -- I would like to use Clojure to build a safe code-remoting application for query injection (moving queries closer to the data for affinity and privacy). One alternative for this application is to read Clojure code

Re: Disable undocumented #= reader macro to prevent unsafe code injection?

2013-04-09 Thread David Powell
Also - take a look at: https://github.com/flatland/clojail -- Dave -- -- You received this message because you are subscribed to the Google Groups Clojure group. To post to this group, send email to clojure@googlegroups.com Note that posts from new members are moderated - please be patient

Re: Disable undocumented #= reader macro to prevent unsafe code injection?

2013-04-09 Thread Andy Fingerhut
On Tue, Apr 9, 2013 at 10:03 AM, rebcabin bc.beck...@gmail.com wrote: The workarounds seem to be disabling or removing the #= reader macro or writing my own custom reader (in addition to a custom evaluator). Disabling #= by binding *read-eval* to false would cause an exception if such an