CODEWITHSUNDEEP
javascriptcouchdbmapreduce
lysdexia
lysdexia

Reputation: 1806

Using "eval" in a couchdb reduce - just how dangerous is this?

My docs contain lists of errors. I have a view which counts the number of docs with a specific error, and an average of how many errors a doc with a given error has.

Map

function (doc) {
var i;
for (i = 0; i < doc.errors.length; i = i + 1){
    emit([doc.errors[i], doc.flummery], [1, doc.errors.length])
}

}

Reduce 

function (key, values, rereduce) {
var avg = [];
var cnt = [];
var i;
for (i = 0; i < values.length; i = i + 1) {
    avg.push(values[i][1]);
    cnt.push(values[i][0]);
}
return [sum(cnt), eval(avg.join("+")) / avg.length]

}

I have read many times that the use of eval() is the path to madness, but I can't think of any way that it could really trip me up here. Is eval() safe in couchdb views?

Note that Oleg came up with the obvious answer, which is "don't do that, couchdb gives you a sum() function". It is obvious in this situation that eval() is not needed. However, should I ever require it, is it safe to use given that I'll have good control over my inputs?

Upvotes: 0

Views: 148

Answers (1)

Oleg V. Volkov
Oleg V. Volkov

Reputation: 22421

Can't you use sum(avg) / avg.length instead?

eval have obvious drawback of calling full power of compiler: it is very resource heavy and introduces a big security hole unless you carefully sanitize your input.

Upvotes: 2

Related Questions