Re: Re: [PEPr] Comment on RFC::EvalForbiddance

Hi Alexey Borzov! On 08/16/05 21:32 you wrote: >>> Of the several packages I maintain two make extensive use of eval() / >>> preg_replace('/.../e'). So I am -1 to forbidding the eval() usage. >> Well, if you look over the proposal again you'll notice that there is a >> section entitled "Exceptions". This means that as long as you can >> justify >> your usage of eval() with _good_ reasons and as long as you take >> special care that nothing maliciously creeps in there, using eval() is >> fine. > Yes, I understood this section. But consider this: without this > proposal, if you don't like the way eval() is used in my packages you > can still open the bug report, start the thread in pear-dev, etc. We > also already have the QA team that theoretically should review the > packages for security threats like these. What exactly prevents these > guys from reviewing packages right now? We currently do. But this has nothing to do with setting up the rule that eval() is highly discouraged in PEAR. This has nothing to do with you or maybe Alan (who uses eval() in DB_DataObject for good reason). I trust you both so far that I don't consider you abuse eval() in the wrong way. > So the only thing you gain from these proposal is a lot of noise from > package developers who are using eval() and would like to continue doing > so. There is no problem with that. We'll review the packages that currently use eval() and open bug reports for cases where we consider it harmful. The rule is mainly to avoid new (maybe somehwat unexperienced?) people to use it. Regards, Toby -- Tobias Schlitt - Zend Certified Engineer GPG Key: 0xA6529579 a passion for php http://www.schlitt.info Like to say "thank you"? - http://pear.php.net/wishlist.php/toby