# Eval without eval?

**URL:** <https://rubytalk.org/t/eval-without-eval/66089>\
**Category:** ruby-talk\
**Created:** [15 August 2012 15:38 UTC](https://rubytalk.org/t/eval-without-eval/66089 "2012-08-15T15:38:59Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![7stud2](https://avatars.discourse-cdn.com/v4/letter/7/9de053/32.png) [@7stud2](https://rubytalk.org/u/7stud2)\
**Post date:** [15 August 2012 15:38 UTC](https://rubytalk.org/t/eval-without-eval/66089/1 "2012-08-15T15:38:59Z")

</div>

Can anyone explain how "Proc.new{}" (String) could be converted into  
Proc.new{} (Code) without using any form of eval?

I am having issues with Sourcify/ ParseTree not evaluating eval-ed codes  
and thinking if that could help.

> **···**
>
> --  
> Posted via [http://www.ruby-forum.com/](http://www.ruby-forum.com/).

---

<div class="post-metadata">

**Author:** ![7stud2](https://avatars.discourse-cdn.com/v4/letter/7/9de053/32.png) [@7stud2](https://rubytalk.org/u/7stud2)\
**Post date:** [15 August 2012 17:48 UTC](https://rubytalk.org/t/eval-without-eval/66089/2 "2012-08-15T17:48:12Z")

</div>

Dipesh Gtm wrote in post #1072447:

> Can anyone explain how "Proc.new{}" (String) could be converted into  
> Proc.new{} (Code) without using any form of eval?

if str == "Proc.new{}"  
&nbsp;&nbsp;return Proc.new  
end

??

> **···**
>
> --  
> Posted via [http://www.ruby-forum.com/\](http://www.ruby-forum.com/%5C).

---

<div class="post-metadata">

**Author:** ![Ryan\_Davis1](https://yyz1.discourse-cdn.com/flex029/user_avatar/rubytalk.org/ryan_davis1/32/1848_2.png) [@Ryan\_Davis1](https://rubytalk.org/u/Ryan_Davis1)\
**Post date:** [15 August 2012 18:41 UTC](https://rubytalk.org/t/eval-without-eval/66089/3 "2012-08-15T18:41:10Z")

</div>

If you have the string, ruby\_parser is probably your best bet.

If you're having problems with either of those two gems, you should file a bug on one or both instead of getting unhelpful advice here (eg Brian).

> **···**
>
> On Aug 15, 2012, at 8:38, Dipesh Gtm \<lists@ruby-forum.com\> wrote:
> 
> > Can anyone explain how "Proc.new{}" (String) could be converted into  
> > Proc.new{} (Code) without using any form of eval?
> > 
> > I am having issues with Sourcify/ ParseTree not evaluating eval-ed codes  
> > and thinking if that could help.

---

<div class="post-metadata">

**Author:** ![theadventmaster](https://avatars.discourse-cdn.com/v4/letter/t/8797f3/32.png) [@theadventmaster](https://rubytalk.org/u/theadventmaster)\
**Post date:** [15 August 2012 18:22 UTC](https://rubytalk.org/t/eval-without-eval/66089/4 "2012-08-15T18:22:27Z")

</div>

Hi Dipesh,

It depends on what you need. Eval is very powerful, but any time you  
permit arbitrary code execution from the contents of a string, there are  
safety concerns. If you're looking to execute or apply a specific block of  
code to particular objects or object instances, consider using blocks and  
yield.

def yieldingMethod ( arg1 )  
&nbsp;&nbsp;&nbsp;&nbsp;yield arg1  
end

yieldingMethod( "Hello, World!" ) do |yieldedValue|

prints yieldedValue

end

If you're calling methods whose names are being dynamically provided,  
consider Class#send, which allows you to provide a method name and pass  
parameters to it.

You can also call Class#const\_get("String") to get a class name at runtime.

If you still feel that eval is the appropriate solution to your problem,  
consider wrapping code blocks in %q{} and %Q{} to make your code easier to  
read and debug.

I am not sure if an equivalent to JavaScript's "new Function( strCode )"  
exists. In JavaScript, new Function() is a potential optimization and  
level of additional security over eval, since the same Function object  
returned from new may be compiled and isn't like to be modified between  
calls. In Ruby, more is done at runtime, so eval is used very commonly.

You may want to read this page on tainted data, for some Ruby security  
configurations: [Programming Ruby: The Pragmatic Programmer's Guide](http://ruby-doc.org/docs/ProgrammingRuby/html/taint.html)

Thanks,  
- Alexander Pritchard

> **···**
>
> On Wed, Aug 15, 2012 at 1:48 PM, Brian Candler \<lists@ruby-forum.com\> wrote:
> 
> > Dipesh Gtm wrote in post #1072447:  
> > \> Can anyone explain how "Proc.new{}" (String) could be converted into  
> > \> Proc.new{} (Code) without using any form of eval?
> > 
> > if str == "Proc.new{}"  
> > &nbsp;&nbsp;return Proc.new  
> > end
> > 
> > ??
> > 
> > --  
> > Posted via [http://www.ruby-forum.com/\](http://www.ruby-forum.com/%5C).

---

<div class="post-metadata">

**Author:** ![7stud2](https://avatars.discourse-cdn.com/v4/letter/7/9de053/32.png) [@7stud2](https://rubytalk.org/u/7stud2)\
**Post date:** [15 August 2012 21:04 UTC](https://rubytalk.org/t/eval-without-eval/66089/5 "2012-08-15T21:04:10Z")

</div>

Ryan Davis wrote in post #1072466:

> > I am having issues with Sourcify/ ParseTree not evaluating eval-ed codes  
> > and thinking if that could help.
> 
> If you have the string, ruby\_parser is probably your best bet.
> 
> If you're having problems with either of those two gems, you should file  
> a bug on one or both instead of getting unhelpful advice here (eg  
> Brian).

I found the question to be unclear to the point of senseless.

(1) If the question was intended to mean "how can I convert an arbitrary  
string containing ruby code to the value which would result from  
executing that code?" (and you don't care about the side effects of  
executing that code), then it seems to me you may as well just eval it.  
But the OP said "not using any form of eval", without giving any reason.

(2) If the question was "how can I eval an arbitrary string of ruby  
code, but limited to a safe subset of functions" (e.g. disable calls to  
Kernel#system) then it becomes a sandboxing question. You could run a  
ruby-in-ruby implementation configured to execute certain constructs but  
not others; or you could run something like the sandbox gem for MRI.

(3) The question actually was 'how "Proc.new{}" (String) could be  
converted into Proc.new{} (Code)', which is a highly limited form of  
(2). Even this is unclear when it says (Code), and I took this to mean  
(Object) or (Value).

I was not being 100% facetious in answering this literally. If you have  
only a handful of different Ruby expressions you want to recognise and  
turn into real objects, then I think a case statement would be a  
perfectly reasonable way to proceed.

case str  
when /\A(\d+)\z/  
&nbsp;&nbsp;$1.to\_i  
... etc  
else  
&nbsp;&nbsp;raise "Invalid expression"  
end

> **···**
>
> --  
> Posted via [http://www.ruby-forum.com/\](http://www.ruby-forum.com/%5C).

---

<div class="post-metadata">

**Author:** ![Ryan\_Davis1](https://yyz1.discourse-cdn.com/flex029/user_avatar/rubytalk.org/ryan_davis1/32/1848_2.png) [@Ryan\_Davis1](https://rubytalk.org/u/Ryan_Davis1)\
**Post date:** [15 August 2012 21:59 UTC](https://rubytalk.org/t/eval-without-eval/66089/6 "2012-08-15T21:59:49Z")

</div>

Then. Don't. Answer.

> **···**
>
> On Aug 15, 2012, at 2:04 PM, Brian Candler \<lists@ruby-forum.com\> wrote:
> 
> > Ryan Davis wrote in post #1072466:
> > 
> > > > I am having issues with Sourcify/ ParseTree not evaluating eval-ed codes  
> > > > and thinking if that could help.
> > > 
> > > If you have the string, ruby\_parser is probably your best bet.
> > > 
> > > If you're having problems with either of those two gems, you should file  
> > > a bug on one or both instead of getting unhelpful advice here (eg  
> > > Brian).
> > 
> > I found the question to be unclear to the point of senseless.