Security: Replace unsafe eval() with safe numeric parsing in core MATLAB library files (Issue #245)

[GaneshPatil7517]

Summary

Fixes #245 - Replaces unsafe eval() calls with safe sscanf()-based numeric parsing in core MATLAB library files.

Security Issue

Core MATLAB functions were using eval() to parse data from files, which could execute arbitrary MATLAB commands if data files were tampered with (e.g., in multi-user labs, shared file systems, or distributed studies).

Changes

Replaced eval() with safe numeric-only parsing in 5 core library files:

File	Line	Change
concore_read.m	28	eval(ins) → sscanf parsing
concore_initval.m	3	eval(simtime_val) → sscanf parsing
concore_default_maxtime.m	6	eval(instr) → sscanf parsing
concore_iport.m	10	eval(...) → sscanf parsing
concore_oport.m	10	eval(...) → sscanf parsing

Out of Scope

Test scripts in testsou/ also contain eval() but are excluded per maintainer guidance to keep changes minimal and focused on core library files.

Behavior

• ✅ [1 2 3] → [1 2 3]
• ✅ 10 → 10
• ✅ [system('rm -rf /'), 0, 0] → Safe failure (no execution)

Notes

• Minimal changes, no refactoring
• No new dependencies or toolboxes
• Backward compatible with existing numeric formats
• Function signatures unchanged

[Copilot]

Pull request overview

This PR addresses Issue #245 by removing unsafe eval() usage in MATLAB codepaths that parse values from files/strings, replacing it with numeric-only parsing.

Changes:

• Replaced eval() with sscanf()-based numeric parsing in concore_read.m, concore_initval.m, concore_default_maxtime.m, and concore_iport.m.
• Added simple input cleanup (strtrim, removal of []) before parsing.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 7 comments.

File	Description
concore_read.m	Replaces eval(ins) with numeric parsing for read payloads.
concore_initval.m	Replaces eval(simtime_val) with numeric parsing for init values.
concore_default_maxtime.m	Replaces eval(instr) with numeric parsing for maxtime.
concore_iport.m	Replaces eval(...) with numeric parsing when extracting port numbers.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[pradeeban]

/gemini review

[GaneshPatil7517]

hey @pradeeban thank you so much for boosting my confidence....