eval-ing a user text. What's the risk ?

Question

I have an html page with a textfield for the user to put expressions like these:

(x+23)*2
((x-y)*(x+y))
x*2/z+y

The user enters them and I use the 'eval' method to execute them. Before calling eval I make a check that there is nothing dodgy (like attempting to define a function or similar).

It seems to me that I should be fine. But am I introducing a security hole because I call 'eval' on user's string. what's the risk ?

Answer 1

All the user can do is to evaluate stuff in the scope of this page. If the user types in horrible script, what can it do to anyone except the user him/herself?

There is nothing the user can eval in that field that could not also be put in the location bar as a bookmarklet - all is run in the scope of the client browser.

Answer 2

The client can call javascript on its client anyway with the help of browser plugins and javascript debugging tools. It would another thing if you'd attempt to run userdefined code on the server, that would be very risky.

Answer 3

If you happen to have jQuery installed something like this may happen if not checked:

$.getScript("test.js");

http://api.jquery.com/jQuery.getScript/

Answer 4

Presumably you are filtering the string the user provides. However there is a risk that there is a sneaky way to accomplish harm that you have overlooked.

Answer 5

The main thing to worry about is if they can form a URL and send it to someone and then have the eval be performed on another machine by clicking the URL. This would be possible if your form uses GET or even if you don't distinguish between GET/POST when you evaluate the form.

There are other things you can do to be even more sure.

Answer 6

If you are only evaling a user's code to that user on that page then you are fine. You start to get security problems when take user entered strings and eval them on other user's visits. If you aren't doing this, then there is no security hole at all. Anyone can Eval Javascript on a page they are visiting, you can't stop them.

Answer 7

What do you mean by "I make a check that there is nothing dodgy"? Blacklisting certain keywords doesn't work. For example,

eval("func"+"tion () { window.alert('haha'); }()");

As Lou said, you have to be worried when you add functionality to the page. If you add a "share this" button which makes a link to http://example.com/mypage?expr=x-1, it wouldn't be difficult to trick an unsuspecting user to click a link which stole cookies.

I'm pretty sure you can find JavaScript sandboxing out there somewhere.