vwiki

User Tools

Site Tools

Trace:
rm24934

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Next revision		Previous revision
rm24934 [2019/10/10 09:42] – created kalaschnikowrm24934 [2019/10/15 11:33] (current) – [rm24934: Avoid usage of eval in JavaScript context] kalaschnikow
Line 1: Line 1:
 +====== rm24934: Avoid usage of eval in JavaScript context ======
  
 +[[https://cust-projects.seeburger.de/redmine/issues/24934|rm24934: Avoid usage of eval in JavaScript context]] [[https://doc.supplyon.de/pages/viewpage.action?spaceKey=S10058&title=Avoid+usage+of+eval%28%29+in+JavaScript+context|In Confluence]]
 +
 +Subtickets:
 +  * **-** [[https://cust-projects.seeburger.de/redmine/issues/33092|rm33092: My Workspace: Eliminate eval() usage for navigation in menus]]
 +  * **-** [[https://cust-projects.seeburger.de/redmine/issues/33093|rm33093: Alert Overview E-mail Notification: Eliminate eval() usage]]
 +
 +
 +===== Possible use cases =====
 +
 +  * JSON -> A JSON string. -> ''{”x”: 1}''
 +  * JSONP -> A use of JSON. -> ''foo({”x”:1})''
 +  * Library -> Function definitions. -> ''function(){...}''
 +  * Read -> Read of a property. -> ''x.foo''
 +  * Assign -> Assignment. -> ''x.foo = 3''
 +  * Typeof -> Type test expression. -> ''typeof(x)!=”undefined”''
 +  * Try -> Trivial try-catch block. -> ''try{x=3;}catch{}''
 +  * Call -> Simple call. -> ''x.foo(1,2,3)''
 +  * Empty -> Blank string. -> ''””''
 +
 +===== Found occurences in airsupply =====
 +
 +==== airsupply\src\resources\airsupply.war\js\cfg\myworkspace\MyWorkspaceGroupingFeature.js -> 59 eval( link ); ====
 +
 +Function?
 +
 +Replacement:
 +<code>
 +new Function() {...}
 +</code>
 +
 +
 +==== Export of search results from IntelliJ ====
 +
 +Pure text:
 +
 +<code>
 +Targets
 +    Occurrences of 'eval(' in Directory D:\dev\intellij_ws\airsupply
 +
 +Found Occurrences  (11 usages found)
 +    Unclassified occurrence  (11 usages found)
 +        airsupply\src\resources\airsupply.war\js\cfg\myworkspace  (1 usage found)
 +            MyWorkspaceGroupingFeature.js  (1 usage found)
 +                59 eval( link );
 +        airsupply\src\resources\airsupply.war\jsp\alerts  (3 usages found)
 +            emailnotifyconf.jsp  (3 usages found)
 +                459 eval(<
 +                460 eval(<
 +                469 eval(<
 +        airsupply\src\resources\airsupply.war\jsp\base\md\material  (1 usage found)
 +            details.jsp  (1 usage found)
 +                668 var pattern = eval("/\\b" +classnametoremove +"\\b/");
 +        airsupply\src\resources\airsupply.war\jsp\base\md\oo  (1 usage found)
 +            spinplugin.jsp  (1 usage found)
 +                201 jsonContent = eval( "(" + req.responseText + ")" );
 +        airsupply\src\resources\airsupply.war\jsp\base\md\org  (1 usage found)
 +            orgdetails.jsp  (1 usage found)
 +                453 var pattern = eval("/\\b" +classnametoremove +"\\b/");
 +        smartiui\src\resources\smartiui.war\js\smarti\data  (1 usage found)
 +            SuiConnection.js  (1 usage found)
 +                300 jsonContent = eval( '(' + response.responseText + ')' );
 +        smartiui\src\resources\smartiui.war\js\smarti\data\deprecated  (1 usage found)
 +            SmartiConnectionManager.js  (1 usage found)
 +                162 jsonContent = eval( "(" + response.responseText + ")" );
 +        smartiui\src\resources\smartiui.war\js\smarti\widgets\table  (2 usages found)
 +            SUITable.js  (2 usages found)
 +                183 var dsPageData = eval( 'lastDSOptions.params.' + x );
 +                185 eval( 'delete lastDSOptions.params.' + x );
 +</code>
 +
 +===== Found occurences in airsupply-core =====
 +
 +==== Export of search results from IntelliJ ====
 +
 +<code>
 +Targets
 +    Occurrences of 'eval' in Directory D:\dev\intellij_ws\airsupply-core
 +Found Occurrences  (19 usages found)
 +    Unclassified occurrence  (19 usages found)
 +        agenda\src\resources\agenda.war\js  (2 usages found)
 +            checkdata.js  (2 usages found)
 +                488 var cobj = eval("document.forms[0].elements['"+column+"_"+rowIdx+"']");
 +                491 obj = eval("document.forms[0].elements['"+column+"_"+i+"']");
 +        agenda\src\resources\agenda.war\jsp\admin\agenda  (6 usages found)
 +            largerow.jsp  (2 usages found)
 +                196 eval(HookOnBodyFunc);
 +                1242 obj = eval("document.forms[0].elements['<%=uColumn%>_<%=uIdx%>']");
 +            tablecontent.jsp  (2 usages found)
 +                232 eval(HookOnBodyFunc);
 +                1847 obj = eval("document.forms[0].elements['<%=uColumn%>_<%=uIdx%>']");
 +            tables.jsp  (2 usages found)
 +                85 checkbx_h = eval("document.forms[0].checked_table_"+name)
 +                151 eval(HookOnBodyFunc);
 +        core\core-ejb\src\resources\core-fragment.war\js  (5 usages found)
 +            datepicker.js  (1 usage found)
 +                18 obj = eval(obj);
 +            functions.js  (4 usages found)
 +                409 dateCheck = eval(dateCheck);
 +                437 dateCheck = eval(dateCheck);
 +                463 dateCheck = eval(dateCheck);
 +                485 dateCheck = eval(dateCheck);
 +        core\core-ejb\src\resources\external\js\yahoo\autocomplete  (6 usages found)
 +            autocomplete-debug.js  (3 usages found)
 +                2745 jsonList = eval("jsonObjParsed." + aSchema[0]);
 +                2774 var jsonObjRaw = eval("(" + oResponse + ")");
 +                2782 jsonList = eval("(jsonObjRaw." + aSchema[0]+")");
 +            autocomplete.js  (3 usages found)
 +                2724 jsonList = eval("jsonObjParsed." + aSchema[0]);
 +                2753 var jsonObjRaw = eval("(" + oResponse + ")");
 +                2761 jsonList = eval("(jsonObjRaw." + aSchema[0]+")");
 +
 +</code>
 +
 +===== Misc =====
 +
 +[[http://janvitek.org/pubs/oopsla12b.pdf|Eval begone!]] - a document about "Evalorizer" - a tool removing evals automatically on the fly. In this document is described which scenarious of ''eval()'' are possible.