3 ms·
Moral of the Story: There's no such thing as an innocuous eval()?
by forrestthewoods 10y ago
Moral of the Story: There's no such thing as an innocuous eval()?
- _nalply 10y agoI use PHP's eval() for an interactive testing environment on a live smallish server. It's like open-heart surgery, so I agree it's not innocuous. Of course I took care to protect the access. This environment is useful for some quick hacks and tests. If this were a bigger deployment with more at stake, I would remove this environment from the production systems. Because, you know, it's not innocuous.
- gurgus 10y agoThis isn't a useful answer for you at all, but I thought I'd mention that there are "kind of" innocuous eval()'s such as Angular's eval() [1] where instead of JS being evaluated (which can lead to nasty things), an Angular expression is evaluated, which is a bit safer. Obviously what I've just said doesn't help solve any problems here, but thought I'd throw it in there anyway :) [1] https://docs.angularjs.org/api/ng/type/$rootScope.Scope#$eval https://docs.angularjs.org/api/ng/type/$rootScope.Scope#$eva...
- 234dd57d2c8db 10y agoThis is false, Angular expressions / sandbox are NOT security. They are not safer at all. Do not execute untrusted Angular expressions.
- shakna 10y agoUnless the language supports first class environments, and you're binding to that. (Like Common LISP, Scheme, Lua, ...)
- penguat 10y agoAnd it needn't look like eval: http://www.jsfuck.com http://www.jsfuck.com