From OWASP AJAX Security Cheat Sheet:
Eval is evil, never use it. Needing to use eval usually indicates a problem in your design.
I understand that
evaling untrusted JS code can lead to a whole world of pain, nonetheless I fail to understand the categoricity of OWASP's prohibition.
The way I understand things it is perfectly possible to use
eval securely, namely when the
eval'd code is trusted.
I'm developing a hobby web app (game) in my spare time (unpublished yet). In this app I do use
eval. Even though this is a single page I sometimes feel it is simpler to make the server send chunks of HTML code to the browser instead of having the browser construct the page from scratch. So this is what I'm doing:
- Have the browser start an XMLHttpRequest to the server for a page fragment;
- Load the received HTML code (this implies
innerHTML, which incidentally is another thing OWASP warns agains)
innerHTMLdoesn't run JS code present in the assigned fragment, search the loaded HTML code for
By doing this I clearly violate OWASP's guidelines. Nonetheless I fail to see how this is any less secure than normal loading a HTML/CSS/JS page from the server w/o AJAX, just by typing the page's address in the browser address bar. In both cases (loading the page from address bar vs
innerHTML'ing and - gasp! -
evaling the response from an AJAX call to the server) there is an implicit assumption of trust to this webpage. If the server is compromised and starts emitting rogue HTML / JS code then everyone is equally screwed even if no evil
eval is used. Otherwise, everyone is equally safe.
However I know that me not being an expert I likely have very limited understanding and if OWASP categorically forbids something then they likely have good reasons for this. Let me ask then, what are the risks of doing what I described?