Skip to content

BSL183 — Executing of external code on the server

← All rules

Summary

Executing of external code on the server

Identifiers

Field Value
Rule code BSL183
Compatible alias ExecuteExternalCode
Severity WARNING
Enabled by default Yes
Implemented Yes
Tags security

Behavior

  • The public identifier BSL183 and alias ExecuteExternalCode are stable.
  • The rule reports the cases documented on this page.
  • Suppressions and project configuration are applied before publication.
  • The rule requires neither an external analyzer nor network access.

Configuration and suppression

BSL### is the primary stable identifier. The compatible alias is accepted in select, ignore, and compatible block suppression comments.

[tool.onec-hbk-bsl]
select = ["BSL183"]
ignore = ["ExecuteExternalCode"]

All three suppression families support both a current line and a range. When an opening comment follows code, it affects only that line. Use any one form:

  • noqa:
Value = "example";  // noqa: BSL183
  • bsl-disable:
Value = "example";  // bsl-disable: BSL183
  • compatible BSLLS form:
Value = "example";  // BSLLS:ExecuteExternalCode-off

When the same opening comment is on a line by itself, it starts a range. Close it with the matching marker from the same family:

// noqa: BSL183
// code without this diagnostic
// noqa-enable: BSL183

// bsl-disable: BSL183
// code without this diagnostic
// bsl-enable: BSL183

// BSLLS:ExecuteExternalCode-off
// code without this diagnostic
// BSLLS:ExecuteExternalCode-on

To disable the rule until the end of the file, omit the closing noqa-enable, bsl-enable, or BSLLS:…-on marker.

Opening and closing markers must belong to the same family.

Description

When you develop applications, note that not only execution of a code written in the Enterprise mode is unsafe, but also places, where the Execute or Eval methods are used to execute the code created based on parameters passed to server functions and procedures. It is forbidden to use the Execute andEval methods in server methods of form modules, commands, objects, etc.

This restriction is not applicable to the code being executed on the client

Examples

Sources