4 ms·

=1;alert("Hi")

by MosheZada 9y ago

=1;alert("Hi")

huhtenberg 9y ago
Wow. You must be a hacker or something.
blauditore 9y ago
You don't need that, just `=alert('Hi')` is enough.
- quickthrower2 9y ago
  =alert(A1) is more "useful" though. The cool thing is you could code some extra features or an entire SPA inside the spreadsheet. Better than XL.
junke 9y ago
Or try to put circular references. A1: 0 A2: =A1+5 A1: =A2*3 If you click on other cells, the values keep increasing. Otherwise, it eventually gives NaN. If you change the steps and first initialize A2, then it converges to NaN immediately.
diminish 9y ago
Omnipotent version: press F12, open console and type alert("Hi") and press Enter.
adamjc 9y ago
Well, yes. You can see in the source provided it's just running `eval` on the contents of the cell
jlebrech 9y ago
yes hack yourself. bravo :) I guess you would have to sanitize when you save and/or load the spreadsheet
- vog 9y ago
  > I guess you would have to sanitize when you save and/or load the spreadsheet Sanitizing? No chance. Either you have a dedicated expression parser, or you run it directly throgh eval. There is no reliable middle ground. Decades of security failures of so-called "sanitizers" show this pretty clearly. (Even if you manage to create a perfect sanitizer today, wait a few months, new features are added to the browser, and new loopholes will appear out of nothing.) But that may be missing the point, because if you want more code quality, more safety and more features, of course you need more code. This demo illustrates the other way around: If you allow for dirty hacks, you can get away with a surprisingly small amount of code.
  - usrusr 9y ago
    Is there really no middle ground? Sanitizers fail because they try to salvage the clean part, only blacklisting some possible inputs. But what if you turn it around? Only send to eval what fits through a matcher for a very small subset of the language. The matcher can even allow invalid inputs if you know that eval will safely reject them (think unbalanced brackets). That matcher will be much easier and safer to implement than a full parser/interpreter for the same subset.
    - vog 9y ago
      > Only send to eval what fits through a matcher for a very small subset of the language That's exactly what I meant by "dedicated expression parser". (Not sure why you name it "matcher", though. Please be aware that a regex-based matcher will almost certainly fail for that task. You usually want a grammar, i.e. parser, which is more powerful, and shorter, and easier to read and to verify.) EDIT: To those who downvoted my clarification, do you care to elaborate?
      - cat199 9y ago
        > EDIT: To those who downvoted my clarification, do you care to elaborate? you are probably making too much sense.
      - 9y ago

=1;alert("Hi")

huhtenberg 9y ago

Wow. You must be a hacker or something.

blauditore 9y ago

You don't need that, just `=alert('Hi')` is enough.

quickthrower2 9y ago
=alert(A1) is more "useful" though. The cool thing is you could code some extra features or an entire SPA inside the spreadsheet. Better than XL.

junke 9y ago

Or try to put circular references. A1: 0 A2: =A1+5 A1: =A2*3 If you click on other cells, the values keep increasing. Otherwise, it eventually gives NaN. If you change the steps and first initialize A2, then it converges to NaN immediately.

diminish 9y ago

Omnipotent version: press F12, open console and type alert("Hi") and press Enter.

adamjc 9y ago

Well, yes. You can see in the source provided it's just running `eval` on the contents of the cell

jlebrech 9y ago

yes hack yourself. bravo :) I guess you would have to sanitize when you save and/or load the spreadsheet

vog 9y ago
> I guess you would have to sanitize when you save and/or load the spreadsheet Sanitizing? No chance. Either you have a dedicated expression parser, or you run it directly throgh eval. There is no reliable middle ground. Decades of security failures of so-called "sanitizers" show this pretty clearly. (Even if you manage to create a perfect sanitizer today, wait a few months, new features are added to the browser, and new loopholes will appear out of nothing.) But that may be missing the point, because if you want more code quality, more safety and more features, of course you need more code. This demo illustrates the other way around: If you allow for dirty hacks, you can get away with a surprisingly small amount of code.
- usrusr 9y ago
  Is there really no middle ground? Sanitizers fail because they try to salvage the clean part, only blacklisting some possible inputs. But what if you turn it around? Only send to eval what fits through a matcher for a very small subset of the language. The matcher can even allow invalid inputs if you know that eval will safely reject them (think unbalanced brackets). That matcher will be much easier and safer to implement than a full parser/interpreter for the same subset.
  - vog 9y ago
    > Only send to eval what fits through a matcher for a very small subset of the language That's exactly what I meant by "dedicated expression parser". (Not sure why you name it "matcher", though. Please be aware that a regex-based matcher will almost certainly fail for that task. You usually want a grammar, i.e. parser, which is more powerful, and shorter, and easier to read and to verify.) EDIT: To those who downvoted my clarification, do you care to elaborate?
    - cat199 9y ago
      > EDIT: To those who downvoted my clarification, do you care to elaborate? you are probably making too much sense.
    - 9y ago