Due to the fact that "formula" takes a character vector with R functions included, it creates a security concern as explained in https://arxiv.org/pdf/1303.4808.pdf.
Situations like this can occur:
userformula <- "speed ~ dist + system('whoami')"
lm(userformula, data=cars)
While I have sensibly audited any functions in my application which take "formula" as a parameter, I am curious:
1) Do any other R functions besides formulas allow for R functions to be included as character vectors as Formula does? Which other functions should I watch out for with the same issue?
2) Is it possible to force a function to take a formula as a param? If so, how can I prevent this?
Edit: I am restricting this to the base R packages.