@@ -41,11 +41,39 @@ npm install --save safer-eval
41
41
42
42
## Implementation recommendations
43
43
44
- Be aware that a ` saferEval('function(){while(true){}}()') ` may run
44
+ ** Use strict mode**
45
+
46
+ Always use ` 'use strict' ` mode in functions/ files calling ` saferEval() ` .
47
+ Otherwise a sandbox breakout may be possible.
48
+
49
+ ``` js
50
+
51
+ ' use strict'
52
+ const saferEval = require (' safer-eval' )
53
+
54
+ function main () {
55
+ ' use strict' // < alternative within function
56
+ const res = saferEval (' new Date()' )
57
+ ...
58
+ }
59
+
60
+ ```
61
+
62
+ ** Run in worker**
63
+
64
+ Be aware that a
65
+
66
+ ``` js
67
+ saferEval (' (function () { while (true) {} })()' )
68
+ ```
69
+
70
+ may run
45
71
infinitely. Consider using the module from within a worker thread which is terminated
46
72
after timeout.
47
73
48
- Avoid passing context props while deserializing data from hostile environments.
74
+ ** Avoid context props**
75
+
76
+ Avoid passing ` context ` props while deserializing data from hostile environments.
49
77
50
78
## Usage
51
79
@@ -66,19 +94,23 @@ Check the tests under "harmful context"!
66
94
in node:
67
95
68
96
``` js
69
- var saferEval = require (' safer-eval' )
70
- var code = ` {d: new Date('1970-01-01'), b: new Buffer('data')}`
71
- var res = saferEval (code)
97
+ ' use strict' // < NEVER FORGET TO ADD STRICT MODE in file/ function
98
+ // < running `saferEval`
99
+ const saferEval = require (' safer-eval' )
100
+ const code = ` {d: new Date('1970-01-01'), b: new Buffer('data')}`
101
+ const res = saferEval (code)
72
102
// => toString.call(res.d) = '[object Date]'
73
103
// => toString.call(res.b) = '[object Buffer]'
74
104
```
75
105
76
106
in browser:
77
107
78
108
``` js
79
- var saferEval = require (' safer-eval' )
80
- var code = ` {d: new Date('1970-01-01'), b: function () { return navigator.userAgent }`
81
- var res = saferEval (code, {navigator : window .navigator })
109
+ ' use strict' // < NEVER FORGET TO ADD STRICT MODE in file/ function
110
+ // < running `saferEval`
111
+ const saferEval = require (' safer-eval' )
112
+ const code = ` {d: new Date('1970-01-01'), b: function () { return navigator.userAgent }`
113
+ const res = saferEval (code, {navigator : window .navigator })
82
114
// => toString.call(res.d) = '[object Date]'
83
115
// => toString.call(res.b) = '[object Function]'
84
116
// => res.b() = "Mozilla/5.0 (..."
@@ -87,19 +119,19 @@ var res = saferEval(code, {navigator: window.navigator})
87
119
To minimize any harmful code injection carefully select the methods you allow in ` context `
88
120
89
121
``` js
90
- var code = ` window.btoa('Hello, world')`
122
+ const code = ` window.btoa('Hello, world')`
91
123
92
124
// AVOID passing a GLOBAL context!!!
93
- var res = saferEval (code, {window : window })
125
+ const res = saferEval (code, {window : window })
94
126
95
127
// BETTER - code needs only access to window.btoa
96
128
const clones = require (' clones' )
97
- var context = {
129
+ const context = {
98
130
window : {
99
131
btoa: clones (window .btoa , window )
100
132
}
101
133
}
102
- var res = saferEval (code ,context)
134
+ const res = saferEval (code ,context)
103
135
// => res = 'SGVsbG8sIHdvcmxk'
104
136
```
105
137
@@ -108,10 +140,12 @@ var res = saferEval(code ,context)
108
140
Use ` new SaferEval() ` to reuse a once created context.
109
141
110
142
``` js
111
- const {SaferEval } = require (' safer-eval' )
143
+ ' use strict' // < NEVER FORGET TO ADD STRICT MODE in file/ function
144
+ // < running `saferEval`
145
+ const { SaferEval } = require (' safer-eval' )
112
146
const safer = new SaferEval ()
113
- var code = ` {d: new Date('1970-01-01'), b: new Buffer('data')}`
114
- var res = safer .runInContext (code)
147
+ const code = ` {d: new Date('1970-01-01'), b: new Buffer('data')}`
148
+ const res = safer .runInContext (code)
115
149
```
116
150
117
151
## License
0 commit comments