I'm curious about the edn format. Is there a way to inject code in the edn format to be evaluated? Have any security issues cropped up?

@benzap that's the difference between clojure.core/read and clojure.edn/read

there's an optional read-eval for the one in core, clojure.edn eliminates that

Interesting, so the only way you could run erroneous code in the edn format is if you explicitly tell it to evaluate?

it's not erroneous per se, it's an explicit feature

we can't prove there are no code injection bugs, but afaik there are none known

+user=> (read-string "#=(+ 1 1)")
2
+user=> (clojure.edn/read-string "#=(+ 1 1)")
RuntimeException No dispatch macro for: =  clojure.lang.Util.runtimeException (Util.java:221)

oh neat

if you care about performance, interop with other langues, or extensibility, there's some advantages to using the cognitect/transit library instead of edn directly

That makes for a good test, i'm trying to develop some sort of a scripting language in clojure, and i'm trying to sandbox it. So far it reads in quoted values

it failed the #=(+ 1 1) value, so maybe i'll have to pass it through the edn reader

Some background on clojure.core/read vs. the edn-limited version of read: http://clojuredocs.org/clojure.core/read

There is a *read-eval* dynamic var you can bind to false during calls to clojure.core/read, but if you are really reading from an untrusted/possibly-malicious source, I wouldn't count on it.

What does cljc stand for?

@caleb.macdonaldblack Pretty sure the c is for "conditionall"

@rauh Ahh that make sense. Cheers

http://planet.clojure.in/ seems to have lost its DNS

@bg Are you aware of this?

The c in cljc is for common @caleb.macdonaldblack @rauh

As in common to many platforms

It looks like slamhound isn’t really maintained. Are there alternative namespace cleanup/linters out there that folks use regularly?

@brycecovert a lot of tools that are used regularly stop getting updated because they rely directly on clojure.core - the clojure.core apis are very stable, and if they aren't dealing with unstable interop it's easy to reach a point where it's effectively "done". There's nothing that's like slamhound but better maintained if that's what you hope to find.

clearly slamhound does have a lot of open issues though

Yeah, the regulary stability of clojars at version 0.1.x is always surprising. However, it looks like there are some key features that are broken in slamhound for for patterns popular in clojure 1.9 (https://github.com/technomancy/slamhound/issues/79)

Sounds like I just need to go fix it 🙂

@brycecovert official word from the author on #clojure on IRC: "it's resting" - haha

there we go. 😉

Almost finished the first alpha of a stack-based scripting language in clojure https://i.imgur.com/IzG35TU.png

Why you ask? I don't know why

It actually runs on the edn-format, so it could be used to make a sandboxed terminal for requests, extending it is super easy

@benzap neat!