Re: os.execute is scary; Jay rants about strings again (was Re: [ANNOUNCE] lua stdlibs release: now Lua 5 compatible)

[Reuben Thomas <rrt@...>]

> os.execute and io.popen are scary functions.  When using them, you have
> to be very certain about the contents of the strings being passed in.
> I'm going to pick on your code, since you were brave enough to post it,
> but this is an underlying problem many of us have run into.  Me, I ran
> into it the hard way.  It would be nice if we could solve it just once.

I'm not sure it's wise to try. Better is to do one of two things: in the
case I've just outlined, it's better to use dirent functions (and more
portable, OS-wise, although admittedly it means you need poslib).

In the case that you really want to use a complex command-line utility,
like

>    execute("find", d, "-type", "f", "-print", PIPE, "xargs", "wc"}

it's better to use execl or execv. Again, poslib is required, but I think
it's just not worth trying to work around the problems of using the shell.

Finally, to do wildcards, use glob.

> It's possible to write this all portably on POSIX systems,

Ditto with exec and glob.

> Now, the usual rant: strings are the root of all evil,

...and execv lets you use arrays of strings, which is The Right Way,
because system commands are really that.

> So in the quest for structural purity, don't make it annoying to do the
> right thing or else people will go back to exec("ls "..d) :-)
                                             ~~~~
I take it you mean "system" here?

This is the main objection to what I propose above. What can't you do
conveniently with exec and glob?

> On that note, specialized interpolation could do some good.

Yes, this is a nice thing about Perl.

> I don't know whether I think adding more syntax is a good idea or not.

Debatable. I get along with .. and format in Lua without getting annoyed
too often. OTOH, $ interpolation rocks.

-- 
http://www.mupsych.org/~rrt/ | golf, n.  a good walk spoiled (Twain)