1

I have a website into which a user enters a line equation (such as y=2x+5) and it displays the equation to them.

Currently, to plot the equation I'm simply running eval() on the input string, like this:

for (x = 0; x < max; x++) {
  y = eval(equation)
  values.push([x, y]);
}

Are there any security implications along with this? The results are neither stored anywhere on my server or shown to other users - so is this just the same as somebody typing a command into the command prompt, or could they do something else bad?

1 Answer 1

1

The eval can't cause anything unusually or exceptionally bad for the server. The server needs to be protected from arbitrary data being sent to it from potentially malicious HTTP(S) clients anyways. However, the eval can be easily abused to temporarily deface the site (only in the user's browser). You may want to implement some kind of filtering on the eval to guard against such pranks.

2
  • Whilst this is true, it is also true to say that most browsers now have an accessible "developer console" that can be used for exactly the same purpose. This sort of behaviour can't be stopped and implementing filtering on the eval statement is more likely to introduce bugs than impact (true) security. Nov 24, 2016 at 11:20
  • If someone wants to deface the site in their own browser, they can open up the developer tools and do it from there (probably more convenient anyway). Nov 24, 2016 at 15:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .