As a control systems student, I’ve been eager to jump into real-world codebases. I recently made my latest open-source contribution to the ControlCore-Project, tackling Issue #245 with my PR: "Security: Replace unsafe eval() with safe numeric parsing in core MATLAB library files".
The goal was to remove dangerous eval() calls used to convert user string inputs into numbers within the core MATLAB functions. Because eval() executes arbitrary code, it opened up serious security risks. I refactored the code to use safer numeric parsing alternatives like str2double() alongside robust validation checks.
The code review process was a great learning experience. A core maintainer, @alex_m, kindly pointed out that my initial refactor broke compatibility with array inputs. They suggested using sscanf() with a custom regex wrapper instead. We had a friendly back-and-forth discussing edge cases, execution speed, and backward compatibility before finally getting all the CI tests green.
This contribution taught me a ton. Beyond learning the security hazards of dynamic evaluation in MATLAB, I got hands-on experience with defensive programming and maintaining legacy test suites. Navigating code reviews used to intimidate me, but this supportive interaction proved that open source is just as much about community and learning as it is about code. I can't wait to pick up my next issue!