columnname injections could take over R session

[sorhawell]

Reading through the code I found this in file:

• in ShinyTreeMenu/R/ShinyTreeMenuHTML.R* treedata <- treedata[eval(parse(text = lookfor))]

I especially discourage use eval-parse in server-side / client-side interactions for security reasons. Client-side injections may be possible. Or at least maintainers have to consider this every time updating the code.

from library(fortunes)...

Thomas Lumley's fortune "If the answer is parse() you should usually rethink the question."

funny example of sql-injection

[emillykkejensen]

Might be something to take into account if doing a code revision - thanks :)