Using the JavaScript eval () Method

Question

Many developers believe that JavaScript's eval() method should be avoided. This idea makes sense in terms of design. It is often used as an ugly workaround when a simpler and better option is available.

However, I do not understand the problems associated with security vulnerabilities. Of course, running eval() gives the hacker the ability to run any JavaScript code that you can run.

But can't they do this? In Chrome, at least the developer tools allow the end user to run their own JavaScript. How is eval() more dangerous than development tools?

Answer 1

As B-Con mentioned, the attacker is not the one sitting at the computer, so he can use eval() already in your script as a means of transferring malicious code to your site in order to use the current user (for example, the user following the malicious link).

The danger of eval() is that it runs on unanalyzed values ​​and can lead to an XSS-based DOM vulnerability.

eg. consider the following code in your HTML (rather contrived, but it demonstrates the problem I hope for)

 <script> eval('alert("Your query string was ' + unescape(document.location.search) + '");'); </script> 

Now, if the query string is ?foo , you just get a warning dialog box about the following: Your query string was ?foo

But what this code will allow the user to do is redirect users from their site to a URL, for example http://www.example.com/page.htm?hello%22);alert(document.cookie+%22 , where www. example.com is your site.

This changes the code that is executed using eval() to

 alert("Your query string was hello"); alert(document.cookie+""); 

(New lines added by me for clarity). Now this can do something more malicious than displaying the current cookie value, since the required code is simply transmitted along the request line with an attacker’s link in encoded form. For example, it can send a cookie to an attacker’s domain in a resource request, allowing it to capture an authentication session.

This applies to any value from user / external input that is unactivated and executed directly in eval() , and not just in the query string, as shown here.

Answer 2

An attacker does not have access to the user's browser developer tools. An attacker is most likely not a user sitting on a computer.

The danger of eval() is that an attacker can manipulate data that is ultimately triggered through eval() other ways. If the string eval() 'd comes from an HTTP connection, the attacker could execute a MITM attack and modify the string. If the string comes from external storage, an attacker could manipulate data in this storage. Etc.