Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #17115

Re: eval - how to

Followups directed to: comp.lang.javascript

Show key headers only | View raw

Cezary Tomczyk wrote:

> W dniu 2012-11-09 14:53, Asen Bozhilov pisze:
> 
> Correct me if I am wrong, but if I will use closure around my methods
> and variables then they are not outside available.

Correct.

> So, potentially bad code, which can be run using Function, have no access
> to my variables and methods, right? Example:
> 
> var t = 50;
> 
> (function(){
>    var s = 100;
> })();

That is a closure.

> (function  () {
>   var a = 10;

That is a closure.

>   Function('a = 20; b = t; c = s;')();

That is *not* a closure.  The assignments are to (usually newly created) 
properties of the Global Object …

>    console.log(a,b,c); //10,50

… so the local variables of the calling context (here: a) are not affected, 
but the global ones (here: b, c) are.

>   })();
> console.log(a,b,c); //20,50

QED.  This code would throw a ReferenceError exception if the innermost 
Function code was strict mode code:

  /* ReferenceError: a is not defined */
  Function('"use strict"; a = 20;')();

Perhaps a figure helps (use a fixed-width font).  Assuming `t' is a global 
variable:

                                                ,--------->----------.
                                                :                    :
                                      ,--------------------.         :
                                      : Global object      :         :
                                      :--------------------.         :
var t = 50; ----------------------------> t : number = 50 --->-.     :
                               ,--------> a : number = 20  :   :     :
                               : ,------> b : number = 50  :   :     :
                               : : ,----> c : number =  ? -------.-. :
                               : : :  `--------------------'   : : : :
                               : : :                           : : : :
(function(){                   : : :  ,--------------------.   : : v :
   var s = 100; ---------------:-:-:----> s : number = 100 :   : : : :
})();                          : : :  `--------------------'   : : : :
                               : : :                           : : : :
(function () {                 : : :   ,-------------------.   : : : :
  var a = 10; -----------------:-:-:-----> a : number = 10 --->----. :
                               : : :   `-------------------'   : : : :
                               : : :                           : : : :
  Function(                    : : :                           : : : :
      'a = 20;' ---------------' : :                           : : : :
    + 'b = t;' ------------------'<----------------------------' : : :
    + 'c = s;' --------------------'<----------------------------' : :
  )();                                                             : :
                                                                   : :
  console.log(a,b,c); //10,50 <------------------------------------' :
})();                                                                :
                                                                     :
console.log(a,b,c); //20,50 <----------------------------------------'

In non-strict code, the error occurs where the `?' is.  In strict code, the 
error occurs earlier, where the second `a' is attempted to be assigned to.  
For strict mode essentially forbids augmenting the Global Object (or any 
other object in the scope chain outside the local execution context) by 
simple assignment to an identifier in function or eval code.

> Then I've got from console "ReferenceError: s is not defined" which is
> expected by me.

Exactly, but your logic is flawed.
 
> So, if we speaking about getting string from server (XMLHttpRequest) and
> execute code what exactly means that using eval is insecure?

Unless in ES 5+ strict mode, the scope chain of eval code is not empty.  
Code can be injected into your program and use the capabilities of your 
program.  You would want only trustworthy code to do that, and there are no 
guarantees.  Besides, eval code is harder to debug.

This can be useful; eval() can be used to hide potentially unsupported 
program syntax.

But if all you want to transfer is data, and not business logic, then you 
should parse the data and you should not allow business logic to be 
injected.


PointedEars
-- 
    realism:    HTML 4.01 Strict
    evangelism: XHTML 1.0 Strict
    madness:    XHTML 1.1 as application/xhtml+xml
                                                    -- Bjoern Hoehrmann

Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

eval - how to Cezary Tomczyk <cezary.tomczyk@gmail.com> - 2012-11-09 12:47 +0100
  Re: eval - how to Asen Bozhilov <asen.bozhilov@gmail.com> - 2012-11-09 05:53 -0800
    Re: eval - how to Cezary Tomczyk <cezary.tomczyk@gmail.com> - 2012-11-09 22:28 +0100
      Re: eval - how to Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-11-10 10:23 +0100
      Re: eval - how to Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-11-10 11:15 +0100
        Re: eval - how to Cezary Tomczyk <cezary.tomczyk@gmail.com> - 2012-11-11 00:35 +0100
          Re: eval - how to Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-11-11 20:34 +0100
    Re: eval - how to Dr J R Stockton <reply1245@merlyn.demon.co.uk.invalid> - 2012-11-10 22:42 +0000
  Re: eval - how to Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-11-09 17:46 +0100
    Re: eval - how to Tim Streater <timstreater@greenbee.net> - 2012-11-09 17:00 +0000
      Re: eval - how to Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-11-09 18:19 +0100
    Re: eval - how to Cezary Tomczyk <cezary.tomczyk@gmail.com> - 2012-11-09 22:49 +0100
      Re: eval - how to Asen Bozhilov <asen.bozhilov@gmail.com> - 2012-11-09 16:40 -0800
        Re: eval - how to Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-11-10 11:36 +0100
          Re: eval - how to Cezary Tomczyk <cezary.tomczyk@gmail.com> - 2012-11-10 13:29 +0100
            Re: eval - how to Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-11-10 13:55 +0100
              Re: eval - how to Cezary Tomczyk <cezary.tomczyk@gmail.com> - 2012-11-10 14:17 +0100
                Re: eval - how to Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-11-10 20:50 +0100
                Re: eval - how to Cezary Tomczyk <cezary.tomczyk@gmail.com> - 2012-11-10 22:54 +0100
                Re: eval - how to Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-11-11 15:22 +0100
                Re: eval - how to Cezary Tomczyk <cezary.tomczyk@gmail.com> - 2012-11-11 16:24 +0100
                Re: eval - how to Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-11-11 19:23 +0100
          Re: eval - how to Asen Bozhilov <asen.bozhilov@gmail.com> - 2012-11-11 10:40 -0800
            Re: eval - how to Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-11-11 20:41 +0100
              Re: eval - how to Asen Bozhilov <asen.bozhilov@gmail.com> - 2012-11-11 13:34 -0800
                Re: eval - how to Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-11-11 23:03 +0100
      Re: eval - how to Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-11-10 10:21 +0100
  Re: eval - how to SAM <stephanemoriaux.NoAdmin@wanadoo.fr.invalid> - 2012-11-10 04:16 +0100

csiph-web