Skip to content

Instantly share code, notes, and snippets.

@hadley

hadley/crazy.r

Created April 4, 2012 20:30
Show Gist options
  • Save hadley/2305356 to your computer and use it in GitHub Desktop.
Save hadley/2305356 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
crazy.r
f <- function() {
c <- match.call()
c[[1]] <- as.name("get")
c[[2]] <- "get"
c
as.function(c(alist(), c))
}
f()()("x")
f <- function() {
c <- match.call()
c[[1]] <- as.name("get")
c[[2]] <- "get"
body(f) <- c
f
}
f()()("x")
@daroczig
Copy link

daroczig commented Apr 4, 2012

Yes, there were "some" ways of calling get not identified by the filtering rules.

I have improved the filter plus implemented your great idea of running commands in a sandboxed environment just to be sure. I hope the sandbox is getting quite mighty now, I have to think about removing some of the needless (but too restrictive) regexp checks.

In short: thanks again! And please try to hack my server with the hardened rules.

@hadley
Copy link
Author

hadley commented Apr 9, 2012 via email

@daroczig
Copy link

daroczig commented Apr 9, 2012

You are right, sorry for the trouble and thanks!
I've pushed a quickfix, and should work now. But after Easter passed I would really start to (re)work the current approach, which could not lead to such buggy issues. I have some ideas to test before.

@daroczig
Copy link

I have extended my testfile and it seems that those nasty bugs are gone now.
Besides that I could redesign the filtering mechanism and made it a lot simpler (with a not so neat hack of modifying formula.character) which seems to make its job ATM. Your really appreciated feedback is still really welcomed!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment