elixirc evaluates .exs files

[mattly]

While I know that elixirc is not meant to compile .exs script files, it seems some third-party tooling does not, and will happily run elixirc my-cpu-hungry-and-possibly-dangerous-script.exs to do things like generate bytecode that will never materialize, check for errors, etc, whereby elixirc will happily execute the code.

Since the main elixir executable will run the script file, perhaps elixirc should check it? Or at the very least, throw an error. I encountered two third-party tools for emacs (alchemist, flycheck) that fall into this pattern of behavior, and it wouldn't surprise me if there are more.

[josevalim]

The file extension is for user convenience, elixirc is going to compile whatever path you give to it.

Also, to be clear, compiling a script does not pose any security concern over executing the script itself, as executing an script and compiling a file is exactly the same process, the only difference is that compilation writes the bytecode to disk after loading it in memory, while executing the script does not.

So I would rather file bug reports on those tools to use the elixirc or elixir executables for the appropriate extensions but I wouldn't restrict the front-end to the compiler directly.

Does it make sense?

[mattly]

Yeah – and I have actually submitted PRs against both of those tools.

I think the problem is more one of expectations – we expect that since elixirc is used for compiling things (and has the effect of also providing errors and warnings), that it's safe to use this for all elixir files, regardless of their intention. Where in a normal program, you have a harness that will handle code execution as desired, in a script you usually want to execute the code then-and-there for a specific purpose.

Perhaps if there was a flag that third-party tools could pass in when they indicate they just want the warnings and errors and not actually attempt to compile, that would be ideal, but since the compile process does appear to actually eval code, I'm not sure that's possible.

[josevalim]

since the compile process does appear to actually eval code, I'm not sure that's possible.

Yes, that would be the case here. So it could take a lot of time too if that module compilation just happens to be slow too.

If they want just to check syntax, using File.read! and Code.string_to_quoted would be the best.

[josevalim]

Yeah – and I have actually submitted PRs against both of those tools.

Btw, this is awesome. Thank you!