rm24934
Table of Contents
rm24934: Avoid usage of eval in JavaScript context
Possible use cases
- JSON → A JSON string. →
{”x”: 1} - JSONP → A use of JSON. →
foo({”x”:1}) - Library → Function definitions. →
function(){…} - Read → Read of a property. →
x.foo - Assign → Assignment. →
x.foo = 3 - Typeof → Type test expression. →
typeof(x)!=”undefined” - Try → Trivial try-catch block. →
try{x=3;}catch{} - Call → Simple call. →
x.foo(1,2,3) - Empty → Blank string. →
””
Found occurences in airsupply
airsupply\src\resources\airsupply.war\js\cfg\myworkspace\MyWorkspaceGroupingFeature.js -> 59 eval( link );
Function?
Replacement:
new Function() {...}
Export of search results from IntelliJ
Pure text:
Targets
Occurrences of 'eval(' in Directory D:\dev\intellij_ws\airsupply
Found Occurrences (11 usages found)
Unclassified occurrence (11 usages found)
airsupply\src\resources\airsupply.war\js\cfg\myworkspace (1 usage found)
MyWorkspaceGroupingFeature.js (1 usage found)
59 eval( link );
airsupply\src\resources\airsupply.war\jsp\alerts (3 usages found)
emailnotifyconf.jsp (3 usages found)
459 eval(<
460 eval(<
469 eval(<
airsupply\src\resources\airsupply.war\jsp\base\md\material (1 usage found)
details.jsp (1 usage found)
668 var pattern = eval("/\\b" +classnametoremove +"\\b/");
airsupply\src\resources\airsupply.war\jsp\base\md\oo (1 usage found)
spinplugin.jsp (1 usage found)
201 jsonContent = eval( "(" + req.responseText + ")" );
airsupply\src\resources\airsupply.war\jsp\base\md\org (1 usage found)
orgdetails.jsp (1 usage found)
453 var pattern = eval("/\\b" +classnametoremove +"\\b/");
smartiui\src\resources\smartiui.war\js\smarti\data (1 usage found)
SuiConnection.js (1 usage found)
300 jsonContent = eval( '(' + response.responseText + ')' );
smartiui\src\resources\smartiui.war\js\smarti\data\deprecated (1 usage found)
SmartiConnectionManager.js (1 usage found)
162 jsonContent = eval( "(" + response.responseText + ")" );
smartiui\src\resources\smartiui.war\js\smarti\widgets\table (2 usages found)
SUITable.js (2 usages found)
183 var dsPageData = eval( 'lastDSOptions.params.' + x );
185 eval( 'delete lastDSOptions.params.' + x );
Found occurences in airsupply-core
Export of search results from IntelliJ
Targets
Occurrences of 'eval' in Directory D:\dev\intellij_ws\airsupply-core
Found Occurrences (19 usages found)
Unclassified occurrence (19 usages found)
agenda\src\resources\agenda.war\js (2 usages found)
checkdata.js (2 usages found)
488 var cobj = eval("document.forms[0].elements['"+column+"_"+rowIdx+"']");
491 obj = eval("document.forms[0].elements['"+column+"_"+i+"']");
agenda\src\resources\agenda.war\jsp\admin\agenda (6 usages found)
largerow.jsp (2 usages found)
196 eval(HookOnBodyFunc);
1242 obj = eval("document.forms[0].elements['<%=uColumn%>_<%=uIdx%>']");
tablecontent.jsp (2 usages found)
232 eval(HookOnBodyFunc);
1847 obj = eval("document.forms[0].elements['<%=uColumn%>_<%=uIdx%>']");
tables.jsp (2 usages found)
85 checkbx_h = eval("document.forms[0].checked_table_"+name)
151 eval(HookOnBodyFunc);
core\core-ejb\src\resources\core-fragment.war\js (5 usages found)
datepicker.js (1 usage found)
18 obj = eval(obj);
functions.js (4 usages found)
409 dateCheck = eval(dateCheck);
437 dateCheck = eval(dateCheck);
463 dateCheck = eval(dateCheck);
485 dateCheck = eval(dateCheck);
core\core-ejb\src\resources\external\js\yahoo\autocomplete (6 usages found)
autocomplete-debug.js (3 usages found)
2745 jsonList = eval("jsonObjParsed." + aSchema[0]);
2774 var jsonObjRaw = eval("(" + oResponse + ")");
2782 jsonList = eval("(jsonObjRaw." + aSchema[0]+")");
autocomplete.js (3 usages found)
2724 jsonList = eval("jsonObjParsed." + aSchema[0]);
2753 var jsonObjRaw = eval("(" + oResponse + ")");
2761 jsonList = eval("(jsonObjRaw." + aSchema[0]+")");
Misc
Eval begone! - a document about “Evalorizer” - a tool removing evals automatically on the fly. In this document is described which scenarious of eval() are possible.
rm24934.txt · Last modified: by kalaschnikow
