cpp-eval-command-discord

[giscus[bot]]

cpp-eval-command-discord

A lightweight C++ Discord API library supporting the entire Discord API, including Slash Commands, Voice/Audio, Sharding, Clustering and more!

https://dpp.dev/cpp-eval-command-discord.html

[joshcoyne]

Hi! Is this a good tutorial to have? While at a high level it emulates javascript eval(), javascript is fully sandboxed. This however is not. I know you have a NOTE, but I think you'd need to accomplish something that avoids a red NOTE to offer a solution like this in the first place.

[joshcoyne]

My understanding is javascript interpreters out the box (v8/duktape/tracemonkey/etc) have no ability for js code to escalate to syscalls without binding the native code calls in, like nodes file io package for instance.

Obvs exploits can happen but we have responsibility as programmers in being proactive in our architecture design. If developers or users ask for something that can easily make their system insecure or broken, I believe the right course of action is to educate on why that is not a valid solution. Especially if folks are coming from interpreter environments such as js/python into c++.

[Jaskowicz1]

That's what brain is saying :P

[joshcoyne]

Then why is a horrible security solution being provided instead of said education, if we are saying the same things? Putting a warning at the top isn't the same thing, it's still an official example.

[Jaskowicz1]

Because we don't agree with eval stuff, we don't want to support people making them, but people kept asking (like @Mishura4 said) so we provided a doc page.

None of us as volunteers have any care to support eval and improve it, so we won't. However, if you wish to improve it yourself, we'd gladly accept a PR!

But overall, we would rather not have any eval stuff (quite literally because this conversation, we do not want to be responsible for any issues and people WILL come into the Discord and have a go if we don't declare something like that, luring people in by trying to be secure is wrong and can lead to many many many issues on our end).

[Mishura4]

Then why is a horrible security solution being provided instead of said education, if we are saying the same things? Putting a warning at the top isn't the same thing, it's still an official example.

Because people really don't like being told "don't do that"

[Neko-Life]

Do we need to remove this or what? What do you want honestly?

It is explicitly stated:

Needless to say, this is very dangerous. If you are asking how to do this, and want to put this into your bot, we trust that you have a very good reason to do so and have considered alternatives before resorting to this. The code below is for educational purposes only

Any sane C++ developer won't be doing this in their production bot, even in JS it is really not recommended to use eval outside experiment/debugging purpose