A domain-specific language (DSL) is a programming language tailored to one problem domain. It lets users express complex ideas with short expressions, such as search operators or spreadsheet formulas. In a web application, evaluating those expressions on the server creates an injection risk: directly applying dynamic evaluation can allow remote code execution. section 12.2
Build a web-based DSL with security boundaries in mind:
- Use an embeddable language such as Lua and control which application objects and context the runtime can access. section 12.2
- Parse the DSL grammar with a toolkit before evaluation, then ensure the resulting execution is properly sandboxed. section 12.16
- Avoid expanding a DSL beyond simple expressions unless you are prepared to provide developer tools such as highlighting, autocomplete, and debugging. section 12.2
Evaluating a controlled expression
A Python application can embed Lua, create a runtime, and execute the expression "2 + 3". The runtime boundary provides control over what application context is exposed to the DSL. section 12.2
