Re: String concat with JSON

Path	csiph.com!feeder.erje.net!1.eu.feeder.erje.net!weretis.net!feeder1.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From	Thomas 'PointedEars' Lahn <PointedEars@web.de>
Newsgroups	comp.lang.javascript
Subject	Re: String concat with JSON
Date	Mon, 10 Oct 2016 12:35:59 +0100
Organization	PointedEars Software (PES)
Lines	64
Message-ID	<1786064.oMNUckLgyt@PointedEars.de> (permalink)
References	<4eKdnfDJCYfNS2fKnZ2dnUU7-YXNnZ2d@westnet.com.au>
Reply-To	Thomas 'PointedEars' Lahn <cljs@PointedEars.de>
Mime-Version	1.0
Content-Type	text/plain; charset="UTF-8"
Content-Transfer-Encoding	8Bit
X-Trace	solani.org 1476099359 32372 eJwFwQkBwDAIA0BL5QkQOWsB/xJ2BwuJlx4Ix2IPe9O7Rdl2i7JQtJ6UyqtFL5mybx+HOXd+EJEQ8Q== (10 Oct 2016 11:35:59 GMT)
X-Complaints-To	abuse@news.solani.org
NNTP-Posting-Date	Mon, 10 Oct 2016 11:35:59 +0000 (UTC)
User-Agent	KNode/4.14.2
X-NNTP-Posting-Host	eJwFwQkRADAIAzBLK0855DAY/iUscSXYYXSary+qsKJhkiWgpzxDDO8908A5+tijN4uYSn4LUBC1
Cancel-Lock	sha1:swjMuHMf3A5V1iMYp5fwGjpIGLA=
X-User-ID	eJwNysERACEIA8CW9EKClgN49F+Czn6X0FS5iTL2A1mgz+Zh+7LoFfrh6AqDMuET7tj5xcpZxGCO181cRF1MXxTe
Xref	csiph.com comp.lang.javascript:31549

Show key headers only | View raw

Andrew Poulos wrote:

> The relevant bits of the LMS code (over which I have no control) are
> 
> setString = "this." + element + ".cmivalue =\"" + value + "\";";

Has “setString” been declared a local variable?  If not, this is not only 
bad style (undeclared variable, will break in strict mode; identifier for a 
variable looking like that for a setter), but another security leak: A 
script running in the background could potentially overwrite the value of 
“setString” before it is used in the subsequent eval() call.

> var result = eval(setString);

One proper way to do this, provided that the value of “element” does not 
contain property accessor syntax (otherwise the proper solution is slightly 
more complex), is:

  try
  {
    this[element].cmivalue = value;
  }
  catch (e)
  {
    if (!(element in this))
    {
      /* Handle bad property access */
    }
  }

That the LMS uses eval() like this is not only very inefficient, it is a 
potential security leak as it allows for code injection.  You should edit 
the LMS source code if you can, and report this as a bug.

> It's trying to set value as "Page_1=["Test Data"]"

Probably you mean “Page_1=["Test Data"]” or "Page_1=[\"Test Data\"]", as the 
above is not a valid string literal.

> Why does adding a string to a JSON string give me an invalid string?

This has nothing to do with JSON.  With a value of "foo" for “element”, and 
that value for “value”, the above is equivalent to

 this.foo.cmivalue = "Page_1=["Test Data"]";
-------------------------------^
Uncaught SyntaxError: Unexpected identifier

<http://PointedEars.de/scripts/faq/cljs/#debugging>

> How do I get a valid string?

At minimum:

  value = value.replace(/"/g, "\\$&");

But AISB, using eval() is inefficient and unsafe.  This replacement is 
insufficient to address that issue.

-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | SVN: <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | ES Matrix: <http://PointedEars.de/es-matrix>
Please do not cc me. / Bitte keine Kopien per E-Mail.

Back to comp.lang.javascript | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

String concat with JSON Andrew Poulos <ap_prog@hotmail.com> - 2016-10-10 10:44 +1100
  Re: String concat with JSON Andrew Poulos <ap_prog@hotmail.com> - 2016-10-10 10:47 +1100
  Re: String concat with JSON Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-10-10 12:35 +0100

csiph-web