Is there a way in Ruby/Rails to execute code that is in a string?

Question

So I have a database of different code samples (read snippets). The code samples are created by users. Is there a way in Rails to execute it?

So for example I have the following code in my database (with id=123):

return @var.reverse

Is there a way for me to execute it? Something like:

@var = 'Hello'
@result = exec(CodeSample.find(123))

So the result would be 'olleH'

Answer 1

You can use eval:

code = '@var.reverse'
@var = 'Hello'
@result = eval(code)  # => "olleH"

But be very careful in doing so; you're giving that code full access to your system. Try out eval('exit()') and see what happens.

Answer 2

To the eval answer (which is the right one) I would add: get thee a copy of the Pickaxe Book (either Programming Ruby or Programming Ruby 1.9 depending on your Ruby version) and read the chapter called "Locking Ruby in the Safe." That chapter is all about Ruby's safe levels and tainted objects, and the chapter opens with exactly your use case and why you need to be paranoid about it.