5 ms·

> Additionally, (() => 5)() doesn't work because we don't allow open and close parens next to each other. Not really, I can write ((/**/)=>5)(/**/) Using e

• Groxx 8y ago
  '((/**/) => 5)(/**/)'.replace(/(\(\s*\)|[^0-9.()+\-*\/><=!&|?:])+/g, '') > "((/**/)=>5)(/**/)" ((/**/)=>5)(/**/) > 5 Yup, this does indeed work.
• tgsovlerkhgsel 8y ago
  Or simply use the replacer to generate what you want - include illegal characters like letters, and once they get removed, you get what you want: `((x)=>5)(x)` becomes `(()=>5)()` once the x is removed. I don't see a way to exploit it, but that means very little (as shown by the fact that the author missed this one).
  • mcphage 8y ago
    > include illegal characters like letters, and once they get removed Removing characters you know to be illegal and then trying to run it anyway is asking for trouble. If it contains illegal characters, it should fail immediately.
• mcphage 8y ago
  If the author is rejecting ‘()’, they should probably also reject ‘/*’ and ‘//‘ as well.
• matheusmoreira 8y ago
  > Using eval on data that are provided by a user is always a bad idea. True. Most bugs with security impact seem to happen in the input handling layer, where user input is parsed into data structures. One of the most fundamental problems in today's networked world is how software must be able to safely communicate with virtually any other computer in the world. Servers are configured to indiscriminately accept connections from anyone who tries to connect; no concept of trust is involved.