Hacker News Reader

Comment by ollran | Hacker News Reader

What's the story behind clojure.core/read-string? I have always wondered why it executes code. There are some examples in the docs: https://clojuredocs.org/clojure.core/read-string

View on HN

I haven't fully grokked it myself. But it relates to the concept and implementation of a Lisp reader.

https://en.wikipedia.org/wiki/Lisp_reader

"Unlike most programming languages, Lisp supports parse-time execution of programs, called "read macros" or "reader macros". These are used to extend the syntax either in universal or program-specific ways."

read-string is a convenience over calling read itself as it will take a string rather than needing you to create a java.io.PushbackReader yourself.

As such read and read-string were implemented as core to Clojure's self interpretation and implementation, not as part of a general safe serialization API.

Unfortunately the temptation was to reach for read-string for de-serialization in general as it was so convenient and in the core. In a dev setting where you control and trust all input that is fine. In other contexts it definitely is not!

Oh yes, reader macros, now I get it. As far as I know, you cannot write your own reader macros in Clojure (unlike in Common Lisp).

Yes you can, but they are a bit constrained in what they can do. For instance, it's easy to write a debug macro that prints the intermediate value of b+c:

(let [a #d (+ b c)] ...)

So the #d reader macro has access to the following form, but gets ignored at a higher level (i.e. when the "let" form is processed)

Fortunately since Clojure 1.5 (released 8 years ago), Clojure provides clojure.edn/read and clojure.edn/read-string which are safe to use.

The clojure reader supports the #= prefix before a form, which will cause the reader to read the following form, pass it to eval, and use the result as if it were part of the passed in data.

    (def #=(symbol "foo") :bar)

Gets read as

    (def foo :bar)

Yeah, so someone could provide a malicious input like:

    (read-string "#=(launch-the-missiles)")

You can turn this feature off, either via a system property or by binding read-eval to false. e.g.

    ;; don't let randos launch missiles
    (binding [*read-eval* false]
      (read-eval "#=(launch-missiles!)"))

If you are just trying to read EDN, use clojure.edn/read-string instead.

Reply on news.ycombinator.com