Allow end user to enter ruby code that I execute -

i working on rails app , there 2 important models, being reminder , matcher.

class reminder < activerecord::base end 

reminders allow user set own schedule something, have text field called "condition" , allow them enter own ruby code.

for example can enter:

date.today.friday? 

if want reminder every friday. have done allow ultimate flexibility in way users can create own reminders.

then have scheduled cron task, loops through of reminders , checks condition , actions them, in:

for reminder in reminder.all   if eval(reminder.condition)     #   end end 

the other use case method there use conditions in matcher model, , harder 1 explain allow user access associated model data in condition, example condition might be:

@matcher.parent.name == "father" && @matcher.parent.children.count < 10 

i know it's scary eval user has input, doing validation on model prevent few "nasty" words "delete, destroy, etc". have build small inplace code editor menu's insert code ace editor.

i love way works allows user ultimate flexibility.

how implemented without using eval?

you cannot trust user input. blocking words not block more imaginative techniques send["d-e-s-t-r-o-y".split('-').join('')] or worse.

an improvement can make, if want it, eval remotely within hardened virtual machine on different user account , verify output of stdout of command matches date format. people can around if allow code execution.

for more powerful code should writing dsl of explicit things want allow. whitelist more secure blacklist because nobody smart enough beat rest of world's imagination combined.