Security: Replace unsafe eval() with safe numeric parsing in core MATLAB library files (Issue #245)

concore_default_maxtime.m

@@ -3,7 +3,10 @@ function concore_default_maxtime(default)
     try
         maxfile = fopen(strcat(concore.inpath,'1/concore.maxtime'));
         instr = fscanf(maxfile,'%c');
-        concore.maxtime = eval(instr);
+        % Safe numeric parsing (replaces unsafe eval)
+        clean_str = strtrim(instr);
+        clean_str = regexprep(clean_str, '[\[\]]', '');
+        concore.maxtime = sscanf(clean_str, '%f');
         fclose(maxfile);
     catch exc 
         concore.maxtime = default;

concore_initval.m

@@ -1,6 +1,9 @@
 function [result] = concore_initval(simtime_val)
     global concore;
-    result = eval(simtime_val);
+    % Safe numeric parsing (replaces unsafe eval)
+    clean_str = strtrim(simtime_val);
+    clean_str = regexprep(clean_str, '[\[\]]', '');
+    result = sscanf(clean_str, '%f').';
     concore.simtime = result(1);
     result = result(2:length(result));
 end

concore_iport.m

@@ -7,7 +7,9 @@
         if isequal(s(i:i+length(target)-1),target)
             for j = i+length(target):length(s)
                 if isequal(s(j),',')||isequal(s(j),'}')
-                   result = eval(s(i+length(target):j-1));
+                   % Safe numeric parsing (replaces unsafe eval)
+                   port_str = strtrim(s(i+length(target):j-1));
+                   result = sscanf(port_str, '%f');
                    return
                 end
             end

concore_read.m

@@ -25,7 +25,10 @@
          ins = inistr;
      end
      concore.s = strcat(concore.s, ins);
-     result = eval(ins);
+     % Safe numeric parsing (replaces unsafe eval)
+     clean_str = strtrim(ins);
+     clean_str = regexprep(clean_str, '[\[\]]', '');
+     result = sscanf(clean_str, '%f').';
      concore.simtime = max(concore.simtime,result(1));
      result = result(2:length(result));
 end