Security: Replace unsafe eval() with safe numeric parsing in core MATLAB library files (Issue #245)

[GaneshPatil7517]

Hey pradeeban,

Fixes #245.

This PR replaces the use of eval() with safer numeric parsing in several core MATLAB library files.

Previously some functions used eval() to read values from files. If those files were modified or tampered with (for example in shared labs or distributed studies), it could allow arbitrary MATLAB commands to run. To avoid this risk, the parsing logic is changed to use sscanf() so only numeric data is processed.

Changes were made in the following core files:

• concore_read.m - replaced eval(ins) with sscanf parsing
• concore_initval.m - replaced eval(simtime_val) with sscanf parsing
• concore_default_maxtime.m - replaced eval(instr) with sscanf parsing
• concore_iport.m - replaced eval(...) with sscanf parsing
• concore_oport.m -replaced eval(...) with sscanf parsing

The test scripts in testsou/ still contain eval(), but they are intentionally left unchanged as discussed earlier to keep this PR focused only on the core library files.

Behavior remains the same for normal numeric inputs. For example:

• [1 2 3] → [1 2 3]
• 10 → 10

If a malicious expression is present (for example [system('rm -rf /'), 0, 0]), it will fail safely and will not execute anything.

This change is minimal and does not introduce new dependencies or toolboxes. Function signatures are unchanged and existing numeric formats continue to work.

[Copilot]

Pull request overview

This PR addresses Issue #245 by removing unsafe eval() usage in MATLAB codepaths that parse values from files/strings, replacing it with numeric-only parsing.

Changes:

• Replaced eval() with sscanf()-based numeric parsing in concore_read.m, concore_initval.m, concore_default_maxtime.m, and concore_iport.m.
• Added simple input cleanup (strtrim, removal of []) before parsing.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 7 comments.

File	Description
concore_read.m	Replaces eval(ins) with numeric parsing for read payloads.
concore_initval.m	Replaces eval(simtime_val) with numeric parsing for init values.
concore_default_maxtime.m	Replaces eval(instr) with numeric parsing for maxtime.
concore_iport.m	Replaces eval(...) with numeric parsing when extracting port numbers.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[pradeeban]

/gemini review

[GaneshPatil7517]

hey @pradeeban thank you so much for boosting my confidence....