Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #26185

Re: alternatives to eval

Show all headers | View raw

Sean Hagen wrote:

> [gandalf23@mail.com wrote: ]
>> 'alert(1)'.replace(/.+/,eval)
> 
> This one seems to actually send 'alert(1)' to the eval function,
> although I'm not entirely sure how.

“eval” is a built-in function; precisely, it is an identifier that refers to 
a Function instance that is a property of the global object. [0]

A reference to a function can be passed as second argument of 
String.prototype.replace(). [1]  The value that the function returns when 
called is used to replace the substring(s) that is/are matched by the 
regular expression specified by reference to an object whose [[Class]] is 
"RegExp" as the first argument, or the result of conversion of the latter to 
a String value, in which case only the first match is replaced.  In any 
case, the match, which is represented by a string value, is passed as first 
argument to the callable.  (Matches for captures, if any, are passed as 
subsequent arguments, and the last two arguments are the index position of 
the match and the string matched against.) [1]  

When passed a string value as first argument, eval() evaluates that value as 
a /Program/. [0]  Since the last result in the Program is the “undefined” 
value which window.alert() returns (in this environment, there is a wrapper 
host object in the scope chain that by casual inspection often is 
indistinguishable from the native global object), and 
String.prototype.replace() returns the string representation of that value 
[1], the Chrome Dev Console shows the string value "undefined".

Bottom line: This code is the error-prone, inefficient equivalent of

  window.alert(1);
 
>> function::['alert'](1)
> 
> […] running [this] in the Chrome Dev console does nothing.

But here it is shown as what it is: a syntax error in conforming 
implementations of ECMAScript (up to Edition 5.1), assuming no syntax 
extensions, conforming  or otherwise, are implemented:

| >>> function::['alert'](1)
| SyntaxError: Unexpected token :

Tested in navigator.userAgent === "Mozilla/5.0 (X11; Linux i686) 
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36".


Please include an attribution line for quotations, see the FAQ.

__________
[0] <http://ecma-international.org/ecma-262/5.1/#sec-15.1.2.1>
[1] <http://ecma-international.org/ecma-262/5.1/#sec-15.5.4.11>
[2] <http://ecma-international.org/ecma-262/5.1/#sec-13.2.1>
-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | SVN: <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | ES Matrix: <http://PointedEars.de/es-matrix>
Please do not cc me. / Bitte keine Kopien per E-Mail.

Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

alternatives to eval gandalf23@mail.com - 2014-11-21 08:23 -0800
  Re: alternatives to eval Bala <k.balamurugan@gmail.com> - 2014-11-21 09:34 -0800
    Re: alternatives to eval gandalf23@mail.com - 2014-11-21 11:10 -0800
  Re: alternatives to eval Sean Hagen <sean.hagen@gmail.com> - 2014-11-21 10:05 -0800
    Re: alternatives to eval Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2014-11-21 20:01 +0100
      Re: alternatives to eval gandalf23@mail.com - 2014-11-21 11:48 -0800
        Re: alternatives to eval Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2014-11-21 21:09 +0100
          Re: alternatives to eval "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2014-11-21 22:41 +0100
            Re: alternatives to eval Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2014-11-26 22:11 +0100
              Re: alternatives to eval "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2014-11-27 00:28 +0100
                Re: alternatives to eval Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2014-11-27 10:37 +0100
                Re: alternatives to eval "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2014-11-27 11:38 +0100
                Re: alternatives to eval Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2014-11-27 12:13 +0100
          Re: alternatives to eval gandalf23@mail.com - 2014-11-21 14:19 -0800

csiph-web