WISH: `load()` to have an option to bust saved unevaluated promise objects (`PROMSXP`)

HenrikBengtsson / Wishlist-for-R

Features and tweaks to R that I and others would love to see - feel free to add yours!

https://github.com/HenrikBengtsson/Wishlist-for-R/issues

GNU Lesser General Public License v3.0

134 stars 4 forks source link

WISH: `load()` to have an option to bust saved unevaluated promise objects (`PROMSXP`) #162

Open chainsawriot opened 6 months ago

chainsawriot commented 6 months ago

Ref

CVE-2024-27322, also the patch
this message by GWS
this issue

AFAIK, there is no way to bust or isolate unevaluated promises at the R level without evaluating them. If save(eval.promises = FALSE) is by design, it would be also possible to make it by design load(remove.promises = FALSE).

TimTaylor commented 6 months ago

For reference/comparison qs (dev version at moment) is now replacing promises with NULL: https://github.com/traversc/qs/issues/93#issuecomment-2089733765

chainsawriot commented 6 months ago

Ivan Krylov's reply and unserializeData.