SRL Archive - Development

exec(String), execfile(String)


noidea

2010-10-25 17:17:28

I contemplated sending in a bug report (for features), but thought there could be discussion about it.
Its very useful in languages like Python. It also helps with organisation.

Could this be added?

Sex

2010-10-25 18:36:02

Could pose security threats, perhaps? Possibly add a firewall sort-of thing for this and It'd be cool. If I'm understanding this right, you mean like exec in php?

i luffs yeww

2010-10-25 18:41:44

^ Security.sex? :)

Sex

2010-10-25 18:46:59

I know, I meant add that into the security extension.

Nava2

2010-10-25 19:17:07

Would allow us to dynamically script :o

Sex

2010-10-25 19:20:06

From: Nava2
Would allow us to dynamically script :o

Yep, it'd be pretty powerful indeed. I'd like to see this added ;).

noidea

2010-10-25 21:09:32

From: Sex
Could pose security threats, perhaps? Possibly add a firewall sort-of thing for this and It'd be cool. If I'm understanding this right, you mean like exec in php?


I dont see how this would pose a security threat. It should be the same as the one in PHP. It's not like stuff would be executed remotely.

moparisthebest

2010-10-26 00:53:43

That type of thing lets you write HORRIBLE code. There is basically never a time when you should call 'exec', any use you have for it, there is a better way to do it.

noidea

2010-10-26 16:50:50

From: moparisthebest
That type of thing lets you write HORRIBLE code. There is basically never a time when you should call 'exec', any use you have for it, there is a better way to do it.


Yes, but certainly execfile could be useful? For example, if you were in an irc channel with hundreds of people continuously tying in commands, execfile would be slower than reading a .py script into a string when the bot is loaded up, then every time the command is called in chat, exec that string.

Wizzup?

2010-10-26 16:56:30

From: moparisthebest
That type of thing lets you write HORRIBLE code. There is basically never a time when you should call 'exec', any use you have for it, there is a better way to do it.


I think they'd mainly use it for IRC bots or something. :)

noidea

2010-10-26 17:05:53

From: Wizzup?
I think they'd mainly use it for IRC bots or something. :)


It was only an example :(
Could be used for.. plugins, I dunno, something similar to an import just, less organised?

Smartzkid

2010-10-26 23:03:05

Run a script straight from the web… it would make a neat concept script.

Polymorphic script?

Sandstorm

2010-10-28 20:21:01

From: Smartzkid
Run a script straight from the web… it would make a neat concept script.

Polymorphic script?


Can see a person who wanted accounts putting up a script on a website, then silently adding code that steals them.

^ Stop that somehow?

noidea

2010-10-28 20:50:17

From: Sandstorm
Can see a person who wanted accounts putting up a script on a website, then silently adding code that steals them.

^ Stop that somehow?


*sigh* This is supposed to be a feature.
Its not Simba's job to prevent hackers. Simba is a tool and like any interpreter there are things that enable malicious people to do naughty things.

Just because someone used POST or w/e to steal accounts does not mean we should remove it. Just because someone uses the socket import in python to attack an irc server, it does not make it the developers job to prevent such events.

Everything can be used in a malicious manner.

Cstrike

2010-11-01 16:37:04

Now I have an idea about a script that retrieves constants of NPC's/IDs from the internet constantly throughout the script so if Jagex updates them for whatever reason, you can dynamically influence the script.