如何将 Ruby 脚本与 object 关联并按需执行（在 Rails 中）？

Question

I'm interested in uploading a script (file) via my Rails application and then being able to execute this on demand.

I imagine the first step here is to handle the file upload such that I a Model which I can reference the file like Model.script . This makes sense to me.

And then from here, my plan is to expose a route/controller method which would execute this script, but I'm not sure how to handle the actual execution inside this method. For example if I had

class Model
  def run_script
    # logic to run self.script
  end
end

How would I execute the associated file/code given that it is a Ruby file? Note that the script does not need to run in the context of the Rails application, it just needs to run.

Answer 1

You can use eval , which will run a Ruby script, but be very, very, careful!

For a detailed explanation see " Code is data, data is code ".

Example:

eval(@model_instance.script)

eval is very dangerous. If you give a user the ability to upload and run an unchecked script, it may create a huge problem. For example, someone can upload a script like this:

User.delete_all

This will delete all users from the users table using a SQL query without invoking any Active Record callbacks.

You can use Ruby's taint method to add some additional safety, but it is not 100% foolproof.

For a detailed example, see " Locking Ruby in the Safe ".