security/no-eval

Dlaczego

Any of these turns a string into running code. If any part of the string can come from a URL, storage, a message or an API, an attacker can run script in the page. They also force a Content Security Policy to allow 'unsafe-eval', which weakens it for everything else.

Poprawka

Parse data with JSON.parse, look functions up in an object (handlers[name]()), and pass functions to timers (setTimeout(() => refresh(), 1000)). Keep 'unsafe-eval' out of the CSP.

Przykłady

// bad
const settings = eval('(' + raw + ')')
setTimeout('refresh()', 1000)
// good
const settings = JSON.parse(raw)
setTimeout(refresh, 1000)

Źródła

• MDN, eval() (never use eval)
• MDN, Content-Security-Policy script-src ('unsafe-eval')

Przeczytaj w terminalu

npx github:dawidolko/frontend-skills explain security/no-eval