Validate Ruby Syntax using Ruby

up vote
0
down vote

favorite

I need to validate that a given string is valid Ruby syntax, programmatically, using Ruby. I imagine one way I can do this is by running the code in an EVAL statement, and detecting syntax errors that way.

What's a more proper, safer way I can accomplish this?

edited Nov 27 at 15:58

asked Nov 19 at 17:01

choey

238

Instead of running the code with EVAL, perhaps just run ruby -c?
– lurker
Nov 19 at 17:07

I need to do this programmatically in the controller action that receives the form submission, and I'd prefer not to use programmatically access the filesystem or command line to do so, unless I'm misunderstanding. Thanks for your help.
– choey
Nov 19 at 17:13

3

This sounds extremely dangerous. Is there any way to do this other than by posting and running raw Ruby code? What's the actual objective here? There's really no "safe" way to run arbitrary code. Shopify has made an effort to contain Ruby in a sandbox so you may want to consider that approach.
– tadman
Nov 19 at 17:26

Definitely, executing the code, as in an eval, would be extremely dangerous, which is why I'd rather a different solution. The goal here is to ensure a string has valid ruby syntax, without executing any arbitrary code.
– choey
Nov 19 at 17:32

1

@sawa thank you for clarifying this - I'll remove the rails references from the question.
– choey
Nov 27 at 15:47

|
show 9 more comments

up vote
0
down vote

favorite

What's a more proper, safer way I can accomplish this?

edited Nov 27 at 15:58

asked Nov 19 at 17:01

choey

238

Instead of running the code with EVAL, perhaps just run ruby -c?
– lurker
Nov 19 at 17:07

I need to do this programmatically in the controller action that receives the form submission, and I'd prefer not to use programmatically access the filesystem or command line to do so, unless I'm misunderstanding. Thanks for your help.
– choey
Nov 19 at 17:13

3

This sounds extremely dangerous. Is there any way to do this other than by posting and running raw Ruby code? What's the actual objective here? There's really no "safe" way to run arbitrary code. Shopify has made an effort to contain Ruby in a sandbox so you may want to consider that approach.
– tadman
Nov 19 at 17:26

Definitely, executing the code, as in an eval, would be extremely dangerous, which is why I'd rather a different solution. The goal here is to ensure a string has valid ruby syntax, without executing any arbitrary code.
– choey
Nov 19 at 17:32

1

@sawa thank you for clarifying this - I'll remove the rails references from the question.
– choey
Nov 27 at 15:47

|
show 9 more comments

up vote
0
down vote

favorite

What's a more proper, safer way I can accomplish this?

edited Nov 27 at 15:58

asked Nov 19 at 17:01

choey

238

What's a more proper, safer way I can accomplish this?

ruby validation syntax

edited Nov 27 at 15:58

asked Nov 19 at 17:01

choey

238

edited Nov 27 at 15:58

asked Nov 19 at 17:01

choey

238

edited Nov 27 at 15:58

asked Nov 19 at 17:01

choey

238

asked Nov 19 at 17:01

choey

238

asked Nov 19 at 17:01

choey

238

Instead of running the code with EVAL, perhaps just run ruby -c?
– lurker
Nov 19 at 17:07

I need to do this programmatically in the controller action that receives the form submission, and I'd prefer not to use programmatically access the filesystem or command line to do so, unless I'm misunderstanding. Thanks for your help.
– choey
Nov 19 at 17:13

3

This sounds extremely dangerous. Is there any way to do this other than by posting and running raw Ruby code? What's the actual objective here? There's really no "safe" way to run arbitrary code. Shopify has made an effort to contain Ruby in a sandbox so you may want to consider that approach.
– tadman
Nov 19 at 17:26

Definitely, executing the code, as in an eval, would be extremely dangerous, which is why I'd rather a different solution. The goal here is to ensure a string has valid ruby syntax, without executing any arbitrary code.
– choey
Nov 19 at 17:32

1

@sawa thank you for clarifying this - I'll remove the rails references from the question.
– choey
Nov 27 at 15:47

|
show 9 more comments

Instead of running the code with EVAL, perhaps just run ruby -c?
– lurker
Nov 19 at 17:07

I need to do this programmatically in the controller action that receives the form submission, and I'd prefer not to use programmatically access the filesystem or command line to do so, unless I'm misunderstanding. Thanks for your help.
– choey
Nov 19 at 17:13

3

This sounds extremely dangerous. Is there any way to do this other than by posting and running raw Ruby code? What's the actual objective here? There's really no "safe" way to run arbitrary code. Shopify has made an effort to contain Ruby in a sandbox so you may want to consider that approach.
– tadman
Nov 19 at 17:26

Definitely, executing the code, as in an eval, would be extremely dangerous, which is why I'd rather a different solution. The goal here is to ensure a string has valid ruby syntax, without executing any arbitrary code.
– choey
Nov 19 at 17:32

1

@sawa thank you for clarifying this - I'll remove the rails references from the question.
– choey
Nov 27 at 15:47

Instead of running the code with EVAL, perhaps just run ruby -c?
– lurker
Nov 19 at 17:07

I need to do this programmatically in the controller action that receives the form submission, and I'd prefer not to use programmatically access the filesystem or command line to do so, unless I'm misunderstanding. Thanks for your help.
– choey
Nov 19 at 17:13

This sounds extremely dangerous. Is there any way to do this other than by posting and running raw Ruby code? What's the actual objective here? There's really no "safe" way to run arbitrary code. Shopify has made an effort to contain Ruby in a sandbox so you may want to consider that approach.
– tadman
Nov 19 at 17:26

Definitely, executing the code, as in an eval, would be extremely dangerous, which is why I'd rather a different solution. The goal here is to ensure a string has valid ruby syntax, without executing any arbitrary code.
– choey
Nov 19 at 17:32

@sawa thank you for clarifying this - I'll remove the rails references from the question.
– choey
Nov 27 at 15:47

|
show 9 more comments

2 Answers
2

active

oldest

votes

up vote
1
down vote

accepted

Let the code string be code. The standard way is to do something like this:

begin

  RubyVM::InstructionSequence.compile(code)

  nil

rescue Exception => e

  ... # Put code here to return `e` itself, print its message, or whatever you like

end

If an error is raised and is rescued, that error will display the syntax error. If not (and nil is returned), then code is syntactically valid Ruby code (which does not guarantee that it is free of other types of errors).

The comments saying it is dangerous to do, etc, does not seem to make sense.

answered Nov 26 at 6:36

sawa

129k27193298

Beautiful - this is exactly what I was looking for. I had previously stated in the question that this code string is coming from the front-end via a ruby editor and ajax, which I later removed to simplify the question, but that is probably why there are comments saying the eval approach is dangerous. I didn't want to be executing arbitrary code coming from the internet, so this solution is much better.
– choey
Nov 26 at 16:37

Using eval may be dangerous, but the comments that I mentioned are those that do not mention eval but say that doing this is dangerous.
– sawa
Nov 27 at 5:13

add a comment |

up vote
0
down vote

I'd consider checking this in the browser with Opal - https://github.com/opal/opal

answered Nov 19 at 17:57

Andrzej Krzywda

1818

This is very cool, and I may use it for checking the syntax on the front-end, but I'm mainly looking for a back-end solution.
– choey
Nov 26 at 16:42

add a comment |

Your Answer

StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53379441%2fvalidate-ruby-syntax-using-ruby%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

2 Answers
2

active

oldest

votes

2 Answers
2

active

oldest

votes

up vote
1
down vote

accepted

Let the code string be code. The standard way is to do something like this:

begin

  RubyVM::InstructionSequence.compile(code)

  nil

rescue Exception => e

  ... # Put code here to return `e` itself, print its message, or whatever you like

end

The comments saying it is dangerous to do, etc, does not seem to make sense.

answered Nov 26 at 6:36

sawa

129k27193298

Beautiful - this is exactly what I was looking for. I had previously stated in the question that this code string is coming from the front-end via a ruby editor and ajax, which I later removed to simplify the question, but that is probably why there are comments saying the eval approach is dangerous. I didn't want to be executing arbitrary code coming from the internet, so this solution is much better.
– choey
Nov 26 at 16:37

Using eval may be dangerous, but the comments that I mentioned are those that do not mention eval but say that doing this is dangerous.
– sawa
Nov 27 at 5:13

add a comment |

up vote
1
down vote

accepted

Let the code string be code. The standard way is to do something like this:

begin

  RubyVM::InstructionSequence.compile(code)

  nil

rescue Exception => e

  ... # Put code here to return `e` itself, print its message, or whatever you like

end

The comments saying it is dangerous to do, etc, does not seem to make sense.

answered Nov 26 at 6:36

sawa

129k27193298

Beautiful - this is exactly what I was looking for. I had previously stated in the question that this code string is coming from the front-end via a ruby editor and ajax, which I later removed to simplify the question, but that is probably why there are comments saying the eval approach is dangerous. I didn't want to be executing arbitrary code coming from the internet, so this solution is much better.
– choey
Nov 26 at 16:37

Using eval may be dangerous, but the comments that I mentioned are those that do not mention eval but say that doing this is dangerous.
– sawa
Nov 27 at 5:13

add a comment |

up vote
1
down vote

accepted

Let the code string be code. The standard way is to do something like this:

begin

  RubyVM::InstructionSequence.compile(code)

  nil

rescue Exception => e

  ... # Put code here to return `e` itself, print its message, or whatever you like

end

The comments saying it is dangerous to do, etc, does not seem to make sense.

answered Nov 26 at 6:36

sawa

129k27193298

Let the code string be code. The standard way is to do something like this:

begin

  RubyVM::InstructionSequence.compile(code)

  nil

rescue Exception => e

  ... # Put code here to return `e` itself, print its message, or whatever you like

end

The comments saying it is dangerous to do, etc, does not seem to make sense.

answered Nov 26 at 6:36

sawa

129k27193298

answered Nov 26 at 6:36

sawa

129k27193298

answered Nov 26 at 6:36

sawa

129k27193298

answered Nov 26 at 6:36

sawa

129k27193298

Beautiful - this is exactly what I was looking for. I had previously stated in the question that this code string is coming from the front-end via a ruby editor and ajax, which I later removed to simplify the question, but that is probably why there are comments saying the eval approach is dangerous. I didn't want to be executing arbitrary code coming from the internet, so this solution is much better.
– choey
Nov 26 at 16:37

Using eval may be dangerous, but the comments that I mentioned are those that do not mention eval but say that doing this is dangerous.
– sawa
Nov 27 at 5:13

add a comment |

Beautiful - this is exactly what I was looking for. I had previously stated in the question that this code string is coming from the front-end via a ruby editor and ajax, which I later removed to simplify the question, but that is probably why there are comments saying the eval approach is dangerous. I didn't want to be executing arbitrary code coming from the internet, so this solution is much better.
– choey
Nov 26 at 16:37

Using eval may be dangerous, but the comments that I mentioned are those that do not mention eval but say that doing this is dangerous.
– sawa
Nov 27 at 5:13

Beautiful - this is exactly what I was looking for. I had previously stated in the question that this code string is coming from the front-end via a ruby editor and ajax, which I later removed to simplify the question, but that is probably why there are comments saying the eval approach is dangerous. I didn't want to be executing arbitrary code coming from the internet, so this solution is much better.
– choey
Nov 26 at 16:37

Using eval may be dangerous, but the comments that I mentioned are those that do not mention eval but say that doing this is dangerous.
– sawa
Nov 27 at 5:13

add a comment |

up vote
0
down vote

I'd consider checking this in the browser with Opal - https://github.com/opal/opal

answered Nov 19 at 17:57

Andrzej Krzywda

1818

This is very cool, and I may use it for checking the syntax on the front-end, but I'm mainly looking for a back-end solution.
– choey
Nov 26 at 16:42

add a comment |

up vote
0
down vote

I'd consider checking this in the browser with Opal - https://github.com/opal/opal

answered Nov 19 at 17:57

Andrzej Krzywda

1818

This is very cool, and I may use it for checking the syntax on the front-end, but I'm mainly looking for a back-end solution.
– choey
Nov 26 at 16:42

add a comment |

up vote
0
down vote

I'd consider checking this in the browser with Opal - https://github.com/opal/opal

answered Nov 19 at 17:57

Andrzej Krzywda

1818

I'd consider checking this in the browser with Opal - https://github.com/opal/opal

answered Nov 19 at 17:57

Andrzej Krzywda

1818

answered Nov 19 at 17:57

Andrzej Krzywda

1818

answered Nov 19 at 17:57

Andrzej Krzywda

1818

answered Nov 19 at 17:57

Andrzej Krzywda

1818

This is very cool, and I may use it for checking the syntax on the front-end, but I'm mainly looking for a back-end solution.
– choey
Nov 26 at 16:42

add a comment |

This is very cool, and I may use it for checking the syntax on the front-end, but I'm mainly looking for a back-end solution.
– choey
Nov 26 at 16:42

This is very cool, and I may use it for checking the syntax on the front-end, but I'm mainly looking for a back-end solution.
– choey
Nov 26 at 16:42

add a comment |

draft saved

draft discarded

Thanks for contributing an answer to Stack Overflow!

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

Some of your past answers have not been well-received, and you're in danger of being blocked from answering.

Please pay close attention to the following guidance:

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

搜尋此網誌

Argthtjtr