Question

I cam across this code from a remoting function (clojurescriptone) where the data sent back from the browser is being read. My question is what is the significance of setting the read-eval to false is ?

(binding [read-eval false] (read-string data))

Thanks,
Murtaza

Answer 1

It is a security measure so the browser cannot send code to be executed in the server. For example if the client/browser send "#=(eval (System/exit 1))" and *read-eval* is true, the server process will exit, which is probably something that you don’t want.

See the difference of behaviour:

(binding [*read-eval* false] (read-string "#=(eval (System/exit 1))"))
(binding [*read-eval* true] (read-string "#=(eval (System/exit 1))"))

Also see the docs on *read-eval*.