Path: csiph.com!usenet.pasdenom.info!weretis.net!feeder4.news.weretis.net!news.musoftware.de!wum.musoftware.de!news.karotte.org!uucp.gnuu.de!newsfeed.arcor.de!newsspool3.arcor-online.net!news.arcor.de.POSTED!not-for-mail Content-Type: text/plain; charset="UTF-8" Message-ID: <2836184.TlQAl5i4AK@PointedEars.de> From: Thomas 'PointedEars' Lahn Reply-To: Thomas 'PointedEars' Lahn Organization: PointedEars Software (PES) Date: Sat, 10 Nov 2012 11:15:39 +0100 User-Agent: KNode/4.4.11 Content-Transfer-Encoding: 8Bit X-Face: %i>XG-yXR'\"2P/C_aO%~;2o~?g0pPKmbOw^=NT`tprDEf++D.m7"}HW6.#=U:?2GGctkL,f89@H46O$ASoW&?s}.k+&. Followup-To: comp.lang.javascript MIME-Version: 1.0 Lines: 110 NNTP-Posting-Date: 10 Nov 2012 11:15:39 CET NNTP-Posting-Host: a3a21096.newsspool2.arcor-online.net X-Trace: DXC=59aQ0Y1nfbkEB;5>eE0T7mA9EHlD;3Ycb4Fo<]lROoRa8kFK`l>hCXB2:Z4fJEM1O2SEVCd X-Complaints-To: usenet-abuse@arcor.de Xref: csiph.com comp.lang.javascript:17115 Cezary Tomczyk wrote: > W dniu 2012-11-09 14:53, Asen Bozhilov pisze: > > Correct me if I am wrong, but if I will use closure around my methods > and variables then they are not outside available. Correct. > So, potentially bad code, which can be run using Function, have no access > to my variables and methods, right? Example: > > var t = 50; > > (function(){ > var s = 100; > })(); That is a closure. > (function () { > var a = 10; That is a closure. > Function('a = 20; b = t; c = s;')(); That is *not* a closure. The assignments are to (usually newly created) properties of the Global Object … > console.log(a,b,c); //10,50 … so the local variables of the calling context (here: a) are not affected, but the global ones (here: b, c) are. > })(); > console.log(a,b,c); //20,50 QED. This code would throw a ReferenceError exception if the innermost Function code was strict mode code: /* ReferenceError: a is not defined */ Function('"use strict"; a = 20;')(); Perhaps a figure helps (use a fixed-width font). Assuming `t' is a global variable: ,--------->----------. : : ,--------------------. : : Global object : : :--------------------. : var t = 50; ----------------------------> t : number = 50 --->-. : ,--------> a : number = 20 : : : : ,------> b : number = 50 : : : : : ,----> c : number = ? -------.-. : : : : `--------------------' : : : : : : : : : : : (function(){ : : : ,--------------------. : : v : var s = 100; ---------------:-:-:----> s : number = 100 : : : : : })(); : : : `--------------------' : : : : : : : : : : : (function () { : : : ,-------------------. : : : : var a = 10; -----------------:-:-:-----> a : number = 10 --->----. : : : : `-------------------' : : : : : : : : : : : Function( : : : : : : : 'a = 20;' ---------------' : : : : : : + 'b = t;' ------------------'<----------------------------' : : : + 'c = s;' --------------------'<----------------------------' : : )(); : : : : console.log(a,b,c); //10,50 <------------------------------------' : })(); : : console.log(a,b,c); //20,50 <----------------------------------------' In non-strict code, the error occurs where the `?' is. In strict code, the error occurs earlier, where the second `a' is attempted to be assigned to. For strict mode essentially forbids augmenting the Global Object (or any other object in the scope chain outside the local execution context) by simple assignment to an identifier in function or eval code. > Then I've got from console "ReferenceError: s is not defined" which is > expected by me. Exactly, but your logic is flawed. > So, if we speaking about getting string from server (XMLHttpRequest) and > execute code what exactly means that using eval is insecure? Unless in ES 5+ strict mode, the scope chain of eval code is not empty. Code can be injected into your program and use the capabilities of your program. You would want only trustworthy code to do that, and there are no guarantees. Besides, eval code is harder to debug. This can be useful; eval() can be used to hide potentially unsupported program syntax. But if all you want to transfer is data, and not business logic, then you should parse the data and you should not allow business logic to be injected. PointedEars -- realism: HTML 4.01 Strict evangelism: XHTML 1.0 Strict madness: XHTML 1.1 as application/xhtml+xml -- Bjoern Hoehrmann