gavid
I wanted to create a way to “safely” evaluate a string containing Elixir code. The code in the string should not be allowed to use any functions or modules (not even those from the Kernel e.g. defmodule/2).
Have I succeeded, or are there still ways to create a string that will allow the function to succeed while violating my criteria above?
def safe_eval(code) when is_binary(code) do
quoted_form = Code.string_to_quoted!(code, existing_atoms_only: true)
Macro.postwalk(quoted_form, fn node ->
if is_tuple(node) and (Kernel.elem(node, 0) in [:__aliases__]) do
raise "Cannot use aliases or references to other modules"
end
end)
{evaluated, _bindings} = Code.eval_string(code, [], %Macro.Env{})
{"ok", evaluated}
end
Where Next?
Trending in Questions
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
Deploy Phoenix to your own VPS with PaaS ease: push-to-deploy, zero downtime, auto SSL, managed Postgres. 14-day free trial at potions.io
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ai
- #ecto-query
- #elixirconf-us
- #blog-post
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #elixirconf-eu
- #api
- #forms
- #metaprogramming
- #hex
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Master modern tools, write cleaner code, and tackle real-world challenges.
Producing high quality Elixir screencasts since 2017.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Most Liked- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
jhogberg
Try
"<<0::size(123456789123456789)>>"Why does it have to be Elixir code? If you can’t call any functions or modules then it sounds restricted enough that you could probably do what you want with a simple DSL instead, and writing an interpreter for a (say) small Lisp-like DSL doesn’t take very long.
adamu
Have you seen Dune - Sandbox for Elixir?
jhogberg
I guess it depends on the threat model, the underlying
:erl_evalmodule wasn’t designed to be safe against a determined attacker: at the very least it’ll be possible for them to exhaust system resources.If it’s just about guarding against accidental calls to other modules and the like, then I think a better approach would be to use the local/non-local function handler functionality in
:erl_evalto filter calls, as nothing can sneak through that (as @hst337 pointed out, dynamic calls still sneak through yours).Code.eval_string/3doesn’t expose this functionality (yet?) so it’ll be a bit of a slog to copy and modifyCode.eval_string/3+:elixir.eval_forms/4, but it can be done.… but you might not have to if
Duneis good enough, as pointed out by @adamuLast Post!
jhogberg
You already have the AST so a simple tree-walking interpreter for that tiny subset shouldn’t take very long to write. I think you could’ve finished one in the time you’ve spent on this thread, only having to deal with literals makes things very easy.