What does the * read-eval * variable do?

Question

I view this code using the remote access function (clojurescriptone), where the data sent back from the browser is read. My question is, what is the meaning of read-eval to false?

(binding [read-eval false] (read data))

Thank you Murtaza

Answer 1

This is a security measure, so the browser cannot send code that will be executed on the server. For example, if the client / browser sends "#=(eval (System/exit 1))" and * read-eval *, it is true that the server process will terminate, which is probably what you don't want.

See the difference in behavior:

 (binding [*read-eval* false] (read-string "#=(eval (System/exit 1))")) (binding [*read-eval* true] (read-string "#=(eval (System/exit 1))")) 

Also see docs * read-eval * .

Answer 2

The main purpose of *read-eval* is to allow the reader to evaluate the expression while reading, usually for something that does not have a letter designation. If *read-eval* true (by default), read and read-string will evaluate the expression following # =. You can see how this function is used when *print-dup* attached to the truth - this means that you want the values ​​printed so that their exact types are saved, in which case you will see that some values ​​are printed by C # = designation. The default value for *print-dup* is false - for most cases, the standard Clojure notation is fine. For example, we usually do not care about the difference between integers and longs.

The *read-eval* function is useful for downloading code, but poses a security risk when used with untrusted input. It is generally recommended prior to Clojure 1.5 to bind *read-eval* false when dealing with user input. However, there are still some problems with reading Java objects that may cause problems. This is fixed in Clojure 1.5. More importantly, Clojure 1.5, clojure.edn/read and clojure.edn/read-string , which do not support any *read-eval* functions. They are safe to read user input representing normal Clojure values ​​defined in EDN format. See http://edn-format.org for more details.