Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #31549

Re: String concat with JSON

Show all headers | View raw

Andrew Poulos wrote:

> The relevant bits of the LMS code (over which I have no control) are
> 
> setString = "this." + element + ".cmivalue =\"" + value + "\";";

Has “setString” been declared a local variable?  If not, this is not only 
bad style (undeclared variable, will break in strict mode; identifier for a 
variable looking like that for a setter), but another security leak: A 
script running in the background could potentially overwrite the value of 
“setString” before it is used in the subsequent eval() call.

> var result = eval(setString);

One proper way to do this, provided that the value of “element” does not 
contain property accessor syntax (otherwise the proper solution is slightly 
more complex), is:

  try
  {
    this[element].cmivalue = value;
  }
  catch (e)
  {
    if (!(element in this))
    {
      /* Handle bad property access */
    }
  }

That the LMS uses eval() like this is not only very inefficient, it is a 
potential security leak as it allows for code injection.  You should edit 
the LMS source code if you can, and report this as a bug.
 
> It's trying to set value as "Page_1=["Test Data"]"

Probably you mean “Page_1=["Test Data"]” or "Page_1=[\"Test Data\"]", as the 
above is not a valid string literal.
  
> Why does adding a string to a JSON string give me an invalid string?

This has nothing to do with JSON.  With a value of "foo" for “element”, and 
that value for “value”, the above is equivalent to

 this.foo.cmivalue = "Page_1=["Test Data"]";
-------------------------------^
Uncaught SyntaxError: Unexpected identifier

<http://PointedEars.de/scripts/faq/cljs/#debugging>

> How do I get a valid string?

At minimum:

  value = value.replace(/"/g, "\\$&");

But AISB, using eval() is inefficient and unsafe.  This replacement is 
insufficient to address that issue.

-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | SVN: <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | ES Matrix: <http://PointedEars.de/es-matrix>
Please do not cc me. / Bitte keine Kopien per E-Mail.

Back to comp.lang.javascript | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

String concat with JSON Andrew Poulos <ap_prog@hotmail.com> - 2016-10-10 10:44 +1100
  Re: String concat with JSON Andrew Poulos <ap_prog@hotmail.com> - 2016-10-10 10:47 +1100
  Re: String concat with JSON Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-10-10 12:35 +0100

csiph-web