16

I read people claim that eval is unsafe when run on arbitrary user input code. I understand this in other languages that run on the server, that access the filesystem, etc. However, why does this matter when executing code in a browser? After all, can't you just fire up Firebug and write any arbitrary script you want anyway? So then how is eval any different?

8
  • 1
    eval() may be a XSS attack vector, if you're not careful Commented Jan 27, 2011 at 3:01
  • 1
    please explain a little further Commented Jan 27, 2011 at 3:04
  • 1
    @Joel: You can check about XSS here: weblogs.java.net/blog/2006/09/27/… . It explains how eval is not safe and vulnerable to XSS. Commented Jan 27, 2011 at 3:15
  • 5
    Why was this closed? The linked "possible duplicate" is about Lisp eval whereas this one is about JavaScript eval. And the other questions linked in the comments are asking "when is eval safe" which IMHO is not the same as "why is eval unsafe". Commented Nov 6, 2013 at 18:57
  • 3
    I don't think this should be closed. This is specifically about JavaScript, where the threats posed by eval in server-side languages often don't apply, because JavaScript doesn't have io access. Commented May 26, 2016 at 16:25

1 Answer 1

19

The danger of eval only rears its ugly head when you are serving a script written by alice to user bob for bob's browser to eval.

e.g. if bob enters his password on your page, alice could have written a keylogger in the user input you evaled and arrange for the data to be encoded in a script that bob will (unknowingly) submit to be served to alice. This is, as @Hunter2 has suggested in the comments, an XSS attack.

If you are not serving to other people, you are correct in assuming it is equivalent to firing up firebug

Sign up to request clarification or add additional context in comments.

Comments

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.