Path: csiph.com!feeder.erje.net!1.eu.feeder.erje.net!weretis.net!feeder1.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From: Thomas 'PointedEars' Lahn <PointedEars@web.de>
Newsgroups: comp.lang.javascript
Subject: Re: String concat with JSON
Date: Mon, 10 Oct 2016 12:35:59 +0100
Organization: PointedEars Software (PES)
Lines: 64
Message-ID: <1786064.oMNUckLgyt@PointedEars.de>
References: <4eKdnfDJCYfNS2fKnZ2dnUU7-YXNnZ2d@westnet.com.au>
Reply-To: Thomas 'PointedEars' Lahn <cljs@PointedEars.de>
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8Bit
X-Trace: solani.org 1476099359 32372 eJwFwQkBwDAIA0BL5QkQOWsB/xJ2BwuJlx4Ix2IPe9O7Rdl2i7JQtJ6UyqtFL5mybx+HOXd+EJEQ8Q== (10 Oct 2016 11:35:59 GMT)
X-Complaints-To: abuse@news.solani.org
NNTP-Posting-Date: Mon, 10 Oct 2016 11:35:59 +0000 (UTC)
User-Agent: KNode/4.14.2
X-NNTP-Posting-Host: eJwFwQkRADAIAzBLK0855DAY/iUscSXYYXSary+qsKJhkiWgpzxDDO8908A5+tijN4uYSn4LUBC1
Cancel-Lock: sha1:swjMuHMf3A5V1iMYp5fwGjpIGLA=
X-User-ID: eJwNysERACEIA8CW9EKClgN49F+Czn6X0FS5iTL2A1mgz+Zh+7LoFfrh6AqDMuET7tj5xcpZxGCO181cRF1MXxTe
Xref: csiph.com comp.lang.javascript:31549

Andrew Poulos wrote:

> The relevant bits of the LMS code (over which I have no control) are
> 
> setString = "this." + element + ".cmivalue =\"" + value + "\";";

Has “setString” been declared a local variable?  If not, this is not only 
bad style (undeclared variable, will break in strict mode; identifier for a 
variable looking like that for a setter), but another security leak: A 
script running in the background could potentially overwrite the value of 
“setString” before it is used in the subsequent eval() call.

> var result = eval(setString);

One proper way to do this, provided that the value of “element” does not 
contain property accessor syntax (otherwise the proper solution is slightly 
more complex), is:

  try
  {
    this[element].cmivalue = value;
  }
  catch (e)
  {
    if (!(element in this))
    {
      /* Handle bad property access */
    }
  }

That the LMS uses eval() like this is not only very inefficient, it is a 
potential security leak as it allows for code injection.  You should edit 
the LMS source code if you can, and report this as a bug.
 
> It's trying to set value as "Page_1=["Test Data"]"

Probably you mean “Page_1=["Test Data"]” or "Page_1=[\"Test Data\"]", as the 
above is not a valid string literal.
  
> Why does adding a string to a JSON string give me an invalid string?

This has nothing to do with JSON.  With a value of "foo" for “element”, and 
that value for “value”, the above is equivalent to

 this.foo.cmivalue = "Page_1=["Test Data"]";
-------------------------------^
Uncaught SyntaxError: Unexpected identifier

<http://PointedEars.de/scripts/faq/cljs/#debugging>

> How do I get a valid string?

At minimum:

  value = value.replace(/"/g, "\\$&");

But AISB, using eval() is inefficient and unsafe.  This replacement is 
insufficient to address that issue.

-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | SVN: <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | ES Matrix: <http://PointedEars.de/es-matrix>
Please do not cc me. / Bitte keine Kopien per E-Mail.