# FormPage does not evaluate arbitrary expression

Why a FormPage that simply evaluates an input expression

FormPage[{"e" -> "Expression"}, #e &]


does not evaluate arbitrary input expressions? It works with 2+2 and other few apparently random expressions, but most of the times it returns "Input cannot be processed. Try again."

EDIT: On Mathematica 11.3 (Linux) one example that does not work is Range[3] , but strangely enough Table[x,{x,1,3}] works. On wolframcloud not even Table works

## 2 Answers

Edit:

Wolfram Support explained that the "Expression" interpreter type is implicitly Restricted to not allow 'side effects'. They agreed that documentation should be improved.

To avoid this issue you can use

Restricted["Expression", All]


Original answer:

It does not evaluate them due to security reasons / to prevent injection type attacks.

The failure has "RestrictionFailure" tag which means that it understands it is an "Expression" but it refuses to process it anyway. Details are not documented though.

Interpreter["Expression"] @ "DeleteDirectory" // InputForm


Failure["RestrictionFailure", <|"MessageTemplate" :> Interpreter::insecure, ...|>]

You can use ToExpression instead but then it is your responsibility to deal which malicious input.

Why Table is worse than Range? I do not know but given Table flexibility it may be very hard to predict whether a given command will e.g. drain all your memory. With Range the syntax is more verbose.

• DeleteDirectory actually works if given as input to FormPage[{"e" -> "Expression"}, #e &] , also Run and ReadString do work. On the other hand Range does not. Evidently it's not a security measure, it's rather nonsense behavior. – Fortsaint Feb 10 at 16:51
• @Fortsaint 1. It is important to recognize that this is a restriction failure, not an interpretation failure. 2. Message name suggests the intention behind this restriction 3. Whether that restriction is handled well is a different story and not my fault. – Kuba Feb 11 at 6:37

In a FormPage, "Expression" is converted to a Interpreter["Expression"] for handling the input string. So the question is about Interpreter["Expression"].

NOTE:This explanation is wrong. In fact, "Expression" (as it will be Interpreter["Expression"]) stands for mathematical expressions rather than wolfram language expressions(which stated in the docs).

For general wolfram language expression, this is what I am using:

FormPage[{"e" -> ToExpression}, #e &]


[A comment to the question]

In your statement Table[x,{x,1,3}] works, I think that's due to it's input as an expression instead of a string, so it's evaluated to be a list of numbers.

When I input it as a string, like this

Interpreter["Expression"]@"Table[x,{x,1,3}]"


or this

Interpreter["Expression"]@ToString@Unevaluated@Table[x, {x, 1, 3}]


it fails.