How secure or insecure is this JavaScript code if run on the server (nodeJS)?

Question

Curious as to what unforeseen issues this type of code might present, if executed on the server. Or if there are any non eval alternatives.

var a = {b:1, c:2, d:3, e:[1,2,3]};
(function(path) { return eval('this'+path) }).call(a, '.e[2]');

where does path come from? besides, return this[path] works — dandavis
– dandavis, Commented Jun 1, 2015 at 18:46
then it's very dangerous, slow, and unneeded, just use the array syntax shown. — dandavis
– dandavis, Commented Jun 1, 2015 at 18:48
don't play cat and mouse. do yourself a favor just get rid of the eval and use a resolve(). look up how to access object properties by a string, it's been answered a lot. godspeed. — dandavis
– dandavis, Commented Jun 1, 2015 at 19:19

Community · Accepted Answer · 2017-05-23 11:51:07Z

1

Given that path is a static value (".e[2]") and a does not have any malicious accessors or so, there is nothing insecure here except that it's totally unnecessary.

However, if path does come from a client or some other untrusted source, then passing it to eval is the worst thing you can do. It can do everything that JS code can do in node - and that is enough to harm you severely.

And yes, there are tons of non-eval alternatives.

edited May 23, 2017 at 11:51

CommunityBot

11 silver badge

answered Jun 1, 2015 at 19:45

Bergi

671k162 gold badges1k silver badges1.5k bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Neil Smithline Over a year ago

comments state that path is a value passed in from the client so it is far from static or secure.

Bergi Over a year ago

@NeilSmithline: Thanks, this wasn't stated in the question. Updated my answer for that case.

Victor S Over a year ago

Yes, I ended up going with lodash 3.9.*'s _.get() which does exactly what I need.

Collectives™ on Stack Overflow

How secure or insecure is this JavaScript code if run on the server (nodeJS)?

1 Answer 1

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related