Security: Replace unsafe eval() with safe numeric parsing in core MATLAB library files (Issue #245)

concore_default_maxtime.m

@@ -3,7 +3,17 @@ function concore_default_maxtime(default)
     try
         maxfile = fopen(strcat(concore.inpath,'1/concore.maxtime'));
         instr = fscanf(maxfile,'%c');
-        concore.maxtime = eval(instr);
+        % Safe numeric parsing (replaces unsafe eval)
+        clean_str = strtrim(instr);
+        clean_str = regexprep(clean_str, '[\[\]]', '');
+        % Normalize commas to whitespace so sscanf can parse all tokens
+        clean_str = strrep(clean_str, ',', ' ');
+        parsed_values = sscanf(clean_str, '%f');
+        if numel(parsed_values) == 1
+            concore.maxtime = parsed_values;
+        else
+            concore.maxtime = default;
+        end
         fclose(maxfile);
     catch exc 
         concore.maxtime = default;

concore_initval.m

@@ -1,6 +1,20 @@
 function [result] = concore_initval(simtime_val)
     global concore;
-    result = eval(simtime_val);
+    % Safe numeric parsing (replaces unsafe eval)
+    clean_str = strtrim(simtime_val);
+    clean_str = regexprep(clean_str, '[\[\]]', '');
+    clean_str = strrep(clean_str, ',', ' ');
+    result = sscanf(clean_str, '%f').';
+    % Guard against empty or invalid numeric input
+    if isempty(result)
+        concore.simtime = 0;
+        result = [];
+        return;
+    end
     concore.simtime = result(1);
-    result = result(2:length(result));
+    if numel(result) >= 2
+        result = result(2:end);
+    else
+        result = [];
+    end
 end

concore_iport.m

@@ -7,7 +7,13 @@
         if isequal(s(i:i+length(target)-1),target)
             for j = i+length(target):length(s)
                 if isequal(s(j),',')||isequal(s(j),'}')
-                   result = eval(s(i+length(target):j-1));
+                   % Safe numeric parsing (replaces unsafe eval)
+                   port_str = strtrim(s(i+length(target):j-1));
+                   result = sscanf(port_str, '%f');
+                   if isempty(result)
+                       % Keep the initialized default value (0) if parsing fails
+                       result = 0;
+                   end
                    return
                 end
             end

concore_oport.m

@@ -7,7 +7,9 @@
         if isequal(s(i:i+length(target)-1),target)
             for j = i+length(target):length(s)
                 if isequal(s(j),',')||isequal(s(j),'}')
-                   result = eval(s(i+length(target):j-1));
+                   % Safe numeric parsing (replaces unsafe eval)
+                   port_str = strtrim(s(i+length(target):j-1));
+                   result = sscanf(port_str, '%f');
                    return
                 end
             end

concore_read.m

@@ -25,7 +25,21 @@
          ins = inistr;
      end
      concore.s = strcat(concore.s, ins);
-     result = eval(ins);
-     concore.simtime = max(concore.simtime,result(1));
-     result = result(2:length(result));
+     % Safe numeric parsing (replaces unsafe eval)
+     clean_str = strtrim(ins);
+     clean_str = regexprep(clean_str, '[\[\]]', '');
+     % Normalize comma delimiters to whitespace so sscanf parses all values
+     clean_str = strrep(clean_str, ',', ' ');
+     result = sscanf(clean_str, '%f').';
+     % Guard against empty parse result to avoid indexing errors
+     if isempty(result)
+         result = [];
+         return;
+     end
+     concore.simtime = max(concore.simtime, result(1));
+     if numel(result) > 1
+         result = result(2:end);
+     else
+         result = [];
+     end
 end