Eliminating evals

[KOLANICH]

No description provided.

[jstasiak]

Hey, thank you for the contribution. I'm happy to merge this if you modify the commit message to say this is being done to simplify things and because eval() is not actually needed here, not because it's a security risk (because it's not in this case).

[KOLANICH]

say this is being done to simplify things and because eval() is not actually needed here, not because it's a security risk (because it's not in this case).

Actually it is, even if it isn't. Because

1. eval when used where it is really needed is really a security risk;
2. usage of eval where it is really unneeded is also a security risk, because it disallows to apply a policy "no evals allowed in the code base", which should be understood as "no eval-related security risk is allowed in the code base". And not being able to avoid security risk is a security risk itself.

[jstasiak]

Without going into details I respectfully disagree. I won't merge this change with the current description unless a plausible attack scenario (that's thwarted by this change) is presented.

[KOLANICH]

I have fixed the commit describtion.

[jstasiak]

Thank you!