The application I’m working at the moment requires to store some source code on the client’s machine, so it could be executed later.

So I chose to store it in the sqlite database and than execute it using:

new Function(sourceCodeTakenFromDatabase)()

But the security side of such approach bothers me. Can someone confirm – is it OK to do so in terms of security and if it’s not – why not and what measures should I take to make it safe?

PS: The Context

I need it to store “down migrations”.

In our application we want to have an ability to easily and quickly revert to the previous version of the application if we found some serious problem in the current one. But there is a problem – migrations – if the new version of the app had migrations we can’t just download and reinstall the previous version of the app – we also have to apply “down migrations” to keep the database state consistent. But the previous version of the app doesn’t have these “down migrations” because they came with the new version.

So the idea is to store these “down migrations” in the database after the “up migrations” were applied. Later when we have to revert to the previous version of the app we can take them from the database and execute.