Question

I’m looking for an easy and safe way to parse a map, and only a map, from a string supplied by an untrusted source. The map contains keywords and numbers. What are the security concerns of using read to do this?

Answer 1

read is by default totally unsafe, it allows arbitrary code execution. Try (read-string "#=(println \"hello\")") as an example.

You can make it safer by binding *read-eval* to false. This will cause an exception to be triggered if there #= notation is used. For example:

(binding [*read-eval* false] (read-string "#=(println \"hello\")"))

Finally, depending on how you are using it there is a potential denial of service attack by supplying a large number of keywords (:foo, :bar). Keywords are interned and never freed so if enough are used the process will run out of memory. There’s some discussion about that on the clojure-dev list.