eval and namespace issues
Nobody has claimed this yet.
- Dominant language
- Racket
- Stars
- 575
- Forks
- 106
- Avg merge
- 2h 1m
- Merged PRs (30d)
- 2
Description
eval accepts arbitrary values, can thus call them inappropriately.
IOW, this type checks fine.
(eval `(,add1 "x"))
Possible solution: change Typed Racket's eval to wrap with #%top-interaction.
define-namespace-anchor exposes the internals of a module.
Possible solutions: The #%top-interaction approach works for local calls to eval, but providing the namespace-anchor or the resulting namespace would allow untyped code to call eval with the same bad results. Another solution would be to ban define-namespace-anchor in typed modules.
In some sense, this issue is unfixable because of module->namespace, but that can be avoided with code inspectors, whereas providing the namespace anchor yourself would not be protectable.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the two examples in the issue: the typed eval call and the define-namespace-anchor scenario. Read the handling of eval, #%top-interaction, namespace anchors, and module->namespace; done requires a decided, enforceable approach that prevents the described unsound calls.
Written by the indexing model from the issue text.
Assessment
- Domain
- compilers, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100