Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #26182 > unrolled thread

alternatives to eval

Back to article view | Back to comp.lang.javascript

Contents

  alternatives to eval gandalf23@mail.com - 2014-11-21 08:23 -0800
    Re: alternatives to eval Bala <k.balamurugan@gmail.com> - 2014-11-21 09:34 -0800
      Re: alternatives to eval gandalf23@mail.com - 2014-11-21 11:10 -0800
    Re: alternatives to eval Sean Hagen <sean.hagen@gmail.com> - 2014-11-21 10:05 -0800
      Re: alternatives to eval Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2014-11-21 20:01 +0100
        Re: alternatives to eval gandalf23@mail.com - 2014-11-21 11:48 -0800
          Re: alternatives to eval Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2014-11-21 21:09 +0100
            Re: alternatives to eval "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2014-11-21 22:41 +0100
              Re: alternatives to eval Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2014-11-26 22:11 +0100
                Re: alternatives to eval "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2014-11-27 00:28 +0100
                  Re: alternatives to eval Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2014-11-27 10:37 +0100
                    Re: alternatives to eval "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2014-11-27 11:38 +0100
                      Re: alternatives to eval Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2014-11-27 12:13 +0100
            Re: alternatives to eval gandalf23@mail.com - 2014-11-21 14:19 -0800

#26182 — alternatives to eval

I'm studying web app hacking, in particular XSS.
The book I'm reading says:

--->
If direct calls to the eval command are not possible, you have other ways to 
execute commands in string form:
  <script>'alert(1)'.replace(/.+/,eval)</script>
  <script>function::['alert'](1)</script>
<---

I don't understand the use of eval above and I don't know what "function::" is.

[toc] | [next] | [standalone]

#26183

On Friday, November 21, 2014 8:23:37 AM UTC-8, gand...@mail.com wrote:
> I'm studying web app hacking, in particular XSS.
> The book I'm reading says:
> 
> --->
> If direct calls to the eval command are not possible, you have other ways to 
> execute commands in string form:
>   <script>'alert(1)'.replace(/.+/,eval)</script>
>   <script>function::['alert'](1)</script>
> <---
> 
> I don't understand the use of eval above and I don't know what "function::" is.

May i know what book you are reading

Thanks,
Bala

[toc] | [prev] | [next] | [standalone]

#26186

On Friday, November 21, 2014 6:35:06 PM UTC+1, Bala wrote:
> May i know what book you are reading

http://www.amazon.com/The-Web-Application-Hackers-Handbook/dp/1118026470

[toc] | [prev] | [next] | [standalone]

#26184

> 'alert(1)'.replace(/.+/,eval)

This one seems to actually send 'alert(1)' to the eval function,
although I'm not entirely sure how.

> function::['alert'](1)

No idea on this one, running it in the Chrome Dev console does nothing.

[toc] | [prev] | [next] | [standalone]

#26185

Sean Hagen wrote:

> [gandalf23@mail.com wrote: ]
>> 'alert(1)'.replace(/.+/,eval)
> 
> This one seems to actually send 'alert(1)' to the eval function,
> although I'm not entirely sure how.

“eval” is a built-in function; precisely, it is an identifier that refers to 
a Function instance that is a property of the global object. [0]

A reference to a function can be passed as second argument of 
String.prototype.replace(). [1]  The value that the function returns when 
called is used to replace the substring(s) that is/are matched by the 
regular expression specified by reference to an object whose [[Class]] is 
"RegExp" as the first argument, or the result of conversion of the latter to 
a String value, in which case only the first match is replaced.  In any 
case, the match, which is represented by a string value, is passed as first 
argument to the callable.  (Matches for captures, if any, are passed as 
subsequent arguments, and the last two arguments are the index position of 
the match and the string matched against.) [1]  

When passed a string value as first argument, eval() evaluates that value as 
a /Program/. [0]  Since the last result in the Program is the “undefined” 
value which window.alert() returns (in this environment, there is a wrapper 
host object in the scope chain that by casual inspection often is 
indistinguishable from the native global object), and 
String.prototype.replace() returns the string representation of that value 
[1], the Chrome Dev Console shows the string value "undefined".

Bottom line: This code is the error-prone, inefficient equivalent of

  window.alert(1);
 
>> function::['alert'](1)
> 
> […] running [this] in the Chrome Dev console does nothing.

But here it is shown as what it is: a syntax error in conforming 
implementations of ECMAScript (up to Edition 5.1), assuming no syntax 
extensions, conforming  or otherwise, are implemented:

| >>> function::['alert'](1)
| SyntaxError: Unexpected token :

Tested in navigator.userAgent === "Mozilla/5.0 (X11; Linux i686) 
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36".


Please include an attribution line for quotations, see the FAQ.

__________
[0] <http://ecma-international.org/ecma-262/5.1/#sec-15.1.2.1>
[1] <http://ecma-international.org/ecma-262/5.1/#sec-15.5.4.11>
[2] <http://ecma-international.org/ecma-262/5.1/#sec-13.2.1>
-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | SVN: <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | ES Matrix: <http://PointedEars.de/es-matrix>
Please do not cc me. / Bitte keine Kopien per E-Mail.

[toc] | [prev] | [next] | [standalone]

#26187

On Friday, November 21, 2014 8:01:19 PM UTC+1, Thomas 'PointedEars' Lahn wrote:
> Sean Hagen wrote:
> > [gandalf23@mail.com wrote: ]
> >> function::['alert'](1)
> > 
> > [...] running [this] in the Chrome Dev console does nothing.
> 
> But here it is shown as what it is: a syntax error in conforming 
> implementations of ECMAScript (up to Edition 5.1), assuming no syntax 
> extensions, conforming  or otherwise, are implemented:
> 
> | >>> function::['alert'](1)
> | SyntaxError: Unexpected token :
> 
> Tested in navigator.userAgent === "Mozilla/5.0 (X11; Linux i686) 
> AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36".

Maybe it works on some old version of Internet Explorer.

[toc] | [prev] | [next] | [standalone]

#26188

gandalf23@mail.com wrote:
^^^^^^^^^^^^^^^^^^
Please fix.

> […] Thomas 'PointedEars' Lahn wrote:
>> | >>> function::['alert'](1)
>> | SyntaxError: Unexpected token :
>> 
>> Tested in navigator.userAgent === "Mozilla/5.0 (X11; Linux i686)
>> AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153
>> Safari/537.36".
> 
> Maybe it works on some old version of Internet Explorer.

Please refrain from making guesses until you can make educated ones.  TIA.

-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | SVN: <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | ES Matrix: <http://PointedEars.de/es-matrix>
Please do not cc me. / Bitte keine Kopien per E-Mail.

[toc] | [prev] | [next] | [standalone]

#26189

Thomas 'PointedEars' Lahn <PointedEars@web.de> wrote on 21 nov 2014 in 
comp.lang.javascript:

> Please refrain from making guesses until you can make educated ones.  TIA.

Guessing is an important part of education, I guess.

-- 
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[toc] | [prev] | [next] | [standalone]

#26216

Evertjan. wrote:

> Thomas 'PointedEars' Lahn wrote:
>> Please refrain from making guesses until you can make educated ones. 
>> TIA.
> 
> Guessing is an important part of education, I guess.

Guess again.

-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | SVN: <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | ES Matrix: <http://PointedEars.de/es-matrix>
Please do not cc me. / Bitte keine Kopien per E-Mail.

[toc] | [prev] | [next] | [standalone]

#26217

Thomas 'PointedEars' Lahn <PointedEars@web.de> wrote on 26 nov 2014 in 
comp.lang.javascript:

> Evertjan. wrote:
> 
>> Thomas 'PointedEars' Lahn wrote:
>>> Please refrain from making guesses until you can make educated ones. 
>>> TIA.
>> 
>> Guessing is an important part of education, I guess.
> 
> Guess again.

Don't be so patronizing, 
your knowledge does not include much selfknowledge.

-- 
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[toc] | [prev] | [next] | [standalone]

#26218

Evertjan. wrote:

> Thomas 'PointedEars' Lahn […] wrote:
>> Evertjan. wrote: 
>>> Thomas 'PointedEars' Lahn wrote:
>>>> Please refrain from making guesses until you can make educated ones.
                                                           ^^^^^^^^^^^^^
>>>> TIA.
>>> Guessing is an important part of education, I guess.
>> Guess again.
> 
> Don't be so patronizing,

Patronizing?  Either your irony detector or your English dictionary is 
b0rked.

But if you insist to keep this serious:

No, guesswork, whether understood as blind guessing or unfounded estimation, 
is _not_ an important part of education because such approach based on them 
can only lead to half-knowledge (incidentally, this is most obvious with 
students of ECMAScript-based programming languages who are frequently 
overconfident because of seeming early successes even without a solid 
theoretical foundation).

One must differentiate between guesswork and informed estimation and 
(scientific) inquiry, whereas the latter two are based on *previous* 
knowledge.  Hence the distinction between guesses and “*educated* guesses”.

> your knowledge does not include much selfknowledge.

Now *that* is patronizing.
 
-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | SVN: <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | ES Matrix: <http://PointedEars.de/es-matrix>
Please do not cc me. / Bitte keine Kopien per E-Mail.

[toc] | [prev] | [next] | [standalone]

#26219

Thomas 'PointedEars' Lahn <PointedEars@web.de> wrote on 27 nov 2014 in 
comp.lang.javascript:

>> your knowledge does not include much selfknowledge.
> 
> Now *that* is patronizing.

It was ment that way, even though I was just stating.

You have an impressional knowledge of Javascript, 
even while you don't like the name,
but IMO your selfknowledge is lacking.


-- 
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[toc] | [prev] | [next] | [standalone]

#26220

Evertjan. wrote:

> Thomas 'PointedEars' Lahn […]:
>>> your knowledge does not include much selfknowledge.
>> Now *that* is patronizing.
> 
> It was ment that way, even though I was just stating.

So it is OK if you patronize others, but not if others IYHO patronize?  
Hypocrite.
 
> You have an impressional knowledge of Javascript,

If only there was such a thing.

> even while you don't like the name,

The name is an invention made up by people who do not dare to know better.

> but IMO your selfknowledge is lacking.

I know who I am.  You don’t.  Let’s leave it at that.

-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | SVN: <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | ES Matrix: <http://PointedEars.de/es-matrix>
Please do not cc me. / Bitte keine Kopien per E-Mail.

[toc] | [prev] | [next] | [standalone]

#26190

On Friday, November 21, 2014 9:09:36 PM UTC+1, Thomas 'PointedEars' Lahn wrote:
> gandalf23@mail.com wrote:
> ^^^^^^^^^^^^^^^^^^
> Please fix.

No, I like it that way.

> 
> > [...] Thomas 'PointedEars' Lahn wrote:
> >> | >>> function::['alert'](1)
> >> | SyntaxError: Unexpected token :
> >> 
> >> Tested in navigator.userAgent === "Mozilla/5.0 (X11; Linux i686)
> >> AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153
> >> Safari/537.36".
> > 
> > Maybe it works on some old version of Internet Explorer.
> 
> Please refrain from making guesses until you can make educated ones.  TIA.

Please refrain from making requests until you can make reasonable ones.

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.javascript

csiph-web