3 ms·

Here's a really good use of eval: https://jsfiddle.net/matthewaveryusa/e6EKV/6/ https://jsfiddle.net/matthewaveryusa/e6EKV/6/ I could have done this without a

Here's a really good use of eval: https://jsfiddle.net/matthewaveryusa/e6EKV/6/ https://jsfiddle.net/matthewaveryusa/e6EKV/6/ I could have done this without an eval if I decided to write an interpreter. Instead I whitelisted a subset of javascript and evaled it -- I believe the code is simpler with the eval than if I were to write a parser + interpreter. I challenge anyone to escape my whitelisting :)

kccqzy 8y ago
That's a really nice example! Your whitelist is pretty restrictive. I was reminded of JSFuck where simply allowing six characters ( ) + [ ] ! would basically allow everything. Although I have to mention, your whitelist still permits undefined (such as x.x) as well as certain strings (0 + /./) I'm also pretty sure the Google Closure library originally used whitelist checking + eval to parse JSON before JSON.stringify was a thing.
jaybosamiya 8y ago
Your whitelisting is quite good! I still haven't been able to do complete code execution yet, but have reasons to believe it might be possible. Simply using `x1` as input causes it to print "deadbeef11 is not defined". Additionally, parens are allowed, and there is the `=>` arrow syntax for defining functions. Thus, we have a way to define variables, a way to define lambda abstractions, as well as a way to perform applications. Therefore, we have the untyped lambda calculus. This is Turing complete, so I have reason to believe that it should be possible to execute arbitrary code. I just need to find some time to do so :) Update: `(x1=>x1(x1))(x1=>x1(x1))` gives "Too much recursion" :D
robocat 8y ago
Generally I always use Function() instead of eval, because Function doesn't capture the current scope (and also it won't interfere with JIT optimisation, and avoids possible memory bloat of variables in closure if you keep references to the functions).
- sbr464 8y ago
  I saw a trick where you just do: const eval2 = eval eval2(...) That put’s it back in global scope, even when assigned within a closure with access to a local variable. The local variable will be undefined, rather than it’s actual value, even when called next to the regular eval(). Odd, I know. Here’s a quote: "any invocation of eval that is not a direct call uses the global environment as its variable environment rather than the caller’s variable environment." ECMAScript 5 standard,
TekMol 8y ago
Looking throught the list of http://www.jsfuck.com http://www.jsfuck.com a lot of the 'basics' can be created in your environment too. For example a string can be created like this: (x=>0)+0 If arbitrary code can be constructed in your environment ... hard to say. But as jaybosamiya has shown, it is at least possible to escape your error handling.

kccqzy 8y ago

That's a really nice example! Your whitelist is pretty restrictive. I was reminded of JSFuck where simply allowing six characters ( ) + [ ] ! would basically allow everything. Although I have to mention, your whitelist still permits undefined (such as x.x) as well as certain strings (0 + /./) I'm also pretty sure the Google Closure library originally used whitelist checking + eval to parse JSON before JSON.stringify was a thing.

jaybosamiya 8y ago

Your whitelisting is quite good! I still haven't been able to do complete code execution yet, but have reasons to believe it might be possible. Simply using `x1` as input causes it to print "deadbeef11 is not defined". Additionally, parens are allowed, and there is the `=>` arrow syntax for defining functions. Thus, we have a way to define variables, a way to define lambda abstractions, as well as a way to perform applications. Therefore, we have the untyped lambda calculus. This is Turing complete, so I have reason to believe that it should be possible to execute arbitrary code. I just need to find some time to do so :) Update: `(x1=>x1(x1))(x1=>x1(x1))` gives "Too much recursion" :D

robocat 8y ago

Generally I always use Function() instead of eval, because Function doesn't capture the current scope (and also it won't interfere with JIT optimisation, and avoids possible memory bloat of variables in closure if you keep references to the functions).

sbr464 8y ago
I saw a trick where you just do: const eval2 = eval eval2(...) That put’s it back in global scope, even when assigned within a closure with access to a local variable. The local variable will be undefined, rather than it’s actual value, even when called next to the regular eval(). Odd, I know. Here’s a quote: "any invocation of eval that is not a direct call uses the global environment as its variable environment rather than the caller’s variable environment." ECMAScript 5 standard,

TekMol 8y ago

Looking throught the list of http://www.jsfuck.com http://www.jsfuck.com a lot of the 'basics' can be created in your environment too. For example a string can be created like this: (x=>0)+0 If arbitrary code can be constructed in your environment ... hard to say. But as jaybosamiya has shown, it is at least possible to escape your error handling.