Re: Namespace/class visibility in eval

2009-09-25 Thread Philipp Meier
On 23 Sep., 15:33, John Harrop wrote: > On Wed, Sep 23, 2009 at 8:50 AM, Philipp Meier wrote: > > Remember that clojure runs in the JVM and a JVM can have a > > SecurityManager which can be configured to allow or deny at most any > > dangeroues operatíon. A java policy file will to the trick, I

Re: Namespace/class visibility in eval

2009-09-24 Thread Eric Tschetter
Thanks for the replies, everyone. I'll look into the clojurebot and see how that works. Also, I do understand that this is potentially opening the door to mis-use of resources, but for now, I'm running in a sufficiently trusted environment that the benefits outweigh the risks (an OOM or CPU DoS

Re: Namespace/class visibility in eval

2009-09-23 Thread John Harrop
On Wed, Sep 23, 2009 at 8:50 AM, Philipp Meier wrote: > On 23 Sep., 03:26, John Harrop wrote: > > But, this looks like a gaping security hole. You're taking an HTTP POST > > request body and eval'ing it. Someone will, sooner or later, try typing > > "(delete all the secret files)" into the web f

Re: Namespace/class visibility in eval

2009-09-23 Thread Philipp Meier
On 23 Sep., 03:26, John Harrop wrote: > On Tue, Sep 22, 2009 at 6:46 PM, Eric Tschetter wrote: > But, this looks like a gaping security hole. You're taking an HTTP POST > request body and eval'ing it. Someone will, sooner or later, try typing > "(delete all the secret files)" into the web form

Re: Namespace/class visibility in eval

2009-09-23 Thread Rick Moynihan
> On Tue, Sep 22, 2009 at 6:46 PM, Eric Tschetter wrote: > But, this looks like a gaping security hole. You're taking an HTTP POST > request body and eval'ing it. Someone will, sooner or later, try typing > "(delete all the secret files)" into the web form and clicking Send. Or > worse, something

Re: Namespace/class visibility in eval

2009-09-22 Thread John Harrop
On Tue, Sep 22, 2009 at 6:46 PM, Eric Tschetter wrote: > If I do just > > curl 'http://localhost:43034/1.0/cloj' -H 'content-type: > application/clojure' -d '(json-str {:howdy ["hi" 1 2 3]})' > > I get this exception > > java.lang.Exception: Unable to resolve symbol: json-str in this > context (N

Namespace/class visibility in eval

2009-09-22 Thread Eric Tschetter
I'm trying to create an HTTP server that is essentially a clojure REPL with some integration into some classes on the server's classpath. I've got something working, but I noticed some things that made me realize I don't quite understand the scope of namespaces/imports in clojure when eval'ing. I