Re: How to get a reference from an eval() string?

Hi exilepanda,

Where are the strings you're putting into eval coming from, are any of them based on user input? If so, you'll have to be very careful to sanitize the user input, otherwise you may be exposed to serious security issues. String eval also has some other disadvantages (syntax errors not detected until runtime, and it's not particularly fast), which is why it's usually discouraged and there are other ways to write the code you're writing. Only if you're sure none of the aforementioned issues are a concern in this case, string eval could be used.

Although it's possible to write some data-walking code without string eval by hand (in which it'd be helpful if you could show some more test cases of what you're trying to to do), maybe in this case the module Data::Diver could be useful to you?

Hope this helps,
-- Hauke D

Comment on Re: How to get a reference from an eval() string?

Replies are listed 'Best First'.
Re^2: How to get a reference from an eval() string? by exilepanda (Friar) on Sep 06, 2016 at 15:49 UTC
Where are the strings you're putting into eval coming from... It's from another program's exported plain text data in a file, and what's inside is a list of flatten object attributes and their value(~400 lines), which looks like: `object.prop.subprop.[0].name = "foo" object.prop.subprop.[1].name = "bar" obj.prop.[0] = "blah" obj.prop.[1] = 1000 ... ...` [download] The vendor of that program exported this for me to do my part with perl implementation. And then my script will rewrite this text file, and the program will import the text file back. I considered about the security issue, anyway the read part seem clean enough for me, that's why I use `eval`. Although my implementation do deal with user input, but since my data are constrained to use `/^[\w\d\., ]+$/i` only, so the write back data should be clean as well... unless it's not;). I just read into `Data::Diver` and found that `my $ref= DiveRef( $root, qw( top 9 new sub ) );` would be useful for me, so Thanks a lot!! Only I thought that would be some build in perl func or syntactical trick can do the job. Seem there should be no simple direct way to do that now.	[reply] [d/l] [select]
Re^3: How to get a reference from an eval() string? by haukex (Archbishop) on Sep 07, 2016 at 12:43 UTC
Hi exilepanda, Only I thought that would be some build in perl func or syntactical trick can do the job. Seem there should be no simple direct way to do that now. Well sure there is :-) `my $data = {}; while (<DATA>) { chomp; my @fields = split /\s[=\.]\s/; build( $data, \@fields, pop @fields ); } sub build { my ($ref, $path, $val) = @_; return $val unless @$path; my $el = shift @$path; if ($el=~/^\[(\d+)\]$/) { $ref->[$1] = build( $ref->[$1], $path, $val ) } else { $ref->{$el} = build( $ref->{$el}, $path, $val ) } return $ref; } __DATA__ object.prop.subprop.[0].name = foo object.prop.subprop.[1].name = bar obj.prop.[0] = blah obj.prop.[1] = 1000` [download] `$data` then looks like so: `{ obj => { prop => ["blah", 1000] }, object => { prop => { subprop => [{ name => "foo" }, { name => "bar" + }] } }, }` [download] And then to walk the data structure: `sub dive { my ($ref,@path) = @_; return $ref unless @path; my $el = shift @path; if ($el=~/^\[(\d+)\]$/) { return dive( $ref->[$1], @path ) } else { return dive( $ref->{$el}, @path ) } } print dive( $data, qw/ obj prop [0] / ), "\n"; # prints "blah" print dive( $data, qw/ object prop subprop [1] name / ), "\n"; # prints "bar"` [download] Hope this helps, -- Hauke D	[reply] [d/l] [select]