3 ms·
> we do not allow eval() (or any other mechanism of "code generation from strings") This is interesting, because preventing code generation from strings goes b
by jamescostian 8y ago
> we do not allow eval() (or any other mechanism of "code generation from strings")
This is interesting, because preventing code generation from strings goes beyond `eval()` and `new Function()` - it also includes things like the output www.jsfuck.com can produce (which can indirectly call things like `eval()` and `new Function()` without ever mentioning `eval` or `new Function` in their source). How do you prevent things like that?
- TheDong 8y agoIf you're doing it at the interpreter level, it's pretty easy to prevent even the most obfuscated versions of such functions. You can entirely remove eval such that even if code contained a very obfuscated form of `eval("foo")` it would get "eval is not defined". Since they're not just sanitizing their input, but rather are forbidding things at the runtime level, things like jsfuck.com are totally irrelevant and should have no bearing on their security.
- meowface 8y agoThey're likely not blacklisting strings but actually removing things from the runtime.
- kentonv 8y agoV8's embedding API provides an explicit option to disable them. https://github.com/v8/v8/blob/53d3f5ba2a7ee77244bdee882da9da188daa4c39/include/v8.h#L9097-L9110 https://github.com/v8/v8/blob/53d3f5ba2a7ee77244bdee882da9da... Line 9097, SetAllowCodeGenerationFromStrings()