1

I have a website into which a user enters a line equation (such as y=2x+5) and it displays the equation to them.

Currently, to plot the equation I'm simply running eval() on the input string, like this:

for (x = 0; x < max; x++) {
  y = eval(equation)
  values.push([x, y]);
}

Are there any security implications along with this? The results are neither stored anywhere on my server or shown to other users - so is this just the same as somebody typing a command into the command prompt, or could they do something else bad?

1

The eval can't cause anything unusually or exceptionally bad for the server. The server needs to be protected from arbitrary data being sent to it from potentially malicious HTTP(S) clients anyways. However, the eval can be easily abused to temporarily deface the site (only in the user's browser). You may want to implement some kind of filtering on the eval to guard against such pranks.

  • Whilst this is true, it is also true to say that most browsers now have an accessible "developer console" that can be used for exactly the same purpose. This sort of behaviour can't be stopped and implementing filtering on the eval statement is more likely to introduce bugs than impact (true) security. – Tim Ebenezer Nov 24 '16 at 11:20
  • If someone wants to deface the site in their own browser, they can open up the developer tools and do it from there (probably more convenient anyway). – Robert Fraser Nov 24 '16 at 15:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.