4 ms·

Happy to see that it uses the safe-eval library, which appears to fix code injection issues. Haven't checked that well though.

• _RPM 11y ago
  "safe eval". What does that even mean?
  • aeharding 11y ago
    "safe-eval lets you execute JavaScript code without having to use the much discouraged and feared upon eval(). safe-eval has access to all the standard JavaScript API of the underlying engine. It is implemented using node's vm module." [1] [1] https://www.npmjs.com/package/safe-eval https://www.npmjs.com/package/safe-eval
    • dsp1234 11y ago
      It's important to note that running code in vm.runInNewContext is not advised for 'untrusted code' according to the documentation. So probably not good to let random people use this bot. "script.runInNewContext() is quite useful, but safely running untrusted code requires a separate process."[0] [0] - https://nodejs.org/api/vm.html#vm_script_runinnewcontext_sandbox_options https://nodejs.org/api/vm.html#vm_script_runinnewcontext_san...
    • realusername 11y ago
      https://github.com/hacksparrow/safe-eval/blob/master/index.js https://github.com/hacksparrow/safe-eval/blob/master/index.j... Maybe it's not a nice idea to use Math.random for secure and unique keys.