Can a javascript string be evaluated as a function without eval?

Question

I'm doing a code audit and the toString method can be overwriten by an attacker due to an unwanted behavior. It is overwritting the toString method with a string rather than a method.

Take the following code :

let a = new Object();
a.toString = "function(){ return 'hello world' }"

a.toString is a string and not a function here. Thus, a.toString() won't work.

Is there any hack possible that would result in accidentally executing the toString string (considering the string can be anything and not considering eval) ?

@T.J.Crowder I'm doing a code audit and the toString method can be rewriten. Since the input is coming from a client, it's overwritting the toString method of the instance with a string sent by a client. I was wondering if there were any security risk here. — AnonBird
– AnonBird, Commented Dec 8, 2018 at 14:26
@T.J.Crowder This is not a wanted behavior but a bug. Rest to discover if this bug is exploitable in some way. — AnonBird
– AnonBird, Commented Dec 8, 2018 at 14:30
@AnonBird - Now that makes sense. :-) I'd include that too. — T.J. Crowder
– T.J. Crowder, Commented Dec 8, 2018 at 14:32
It depends on what the attacker can do and what the rest of the code does with your a object. — melpomene
– melpomene, Commented Dec 8, 2018 at 14:34
@melpomene The whole (every method and attributes) of the object can be overwritten. Since this is a get variable coming from the client, I guess the only used method here is toString. This is a bug bounty and I don't have access to the source code. — AnonBird
– AnonBird, Commented Dec 8, 2018 at 14:45

T.J. Crowder · Accepted Answer · 2018-12-08 14:34:32Z

From your clarifying comment:

I'm doing a code audit and the toString method can be rewriten. Since the input is coming from a client, it's overwritting the toString method of the instance with a string sent by a client. I was wondering if there were any security risk here.

Unless your code does something to turn that string into a function (eval(a.toString), new Function(a.toString), btn.onclick = a.toString;, ...), it won't become one, so in that sense it's not a security risk. Anything attempting to call toString on a (explicitly or implicitly) will get an error instead. For instance, here's an implicit use of toString:

let a = new Object();
a.toString = "function(){ return 'hello world' }"
String(a); // TypeError: a.toString is not a function

It's obviously not desirable, but you said it was a bug and you're trying to explore the degree to which it could be exploited. I'd say it's not particularly exploitable.

Collectives™ on Stack Overflow

Can a javascript string be evaluated as a function without eval?

1 Answer 1

Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Linked

Related