Security News
tea.xyz Spam Plagues npm and RubyGems Package Registries
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
safer-eval
Advanced tools
Readme
harmful as eval
This approach has proven to be HARMFUL and does not suit as repacement for eval in node and browser.
Before using this module, ask yourself if there are no better options than using saferEval.
It is potentially better than the bad old eval()
but has harmful potential.
Checkout the "harmful context" tests section.
Warning: The saferEval
function is harmful - so you are warned!
Better packages:
If you like to post exploits you found on this module, feel free to do so. Please file an issue with your findings.
Maybe this helps then others to build a better sandbox.
In node the vm
module is used to sandbox the evaluation of code
.
The browser version browser.js
might not be as safe as the node version
index.js
as here no real sandboxing is available. Please consider modules like
sandboxr.
Runs on node and in modern browsers:
Versions | |
---|---|
node | 8, 10, 11, 12 |
Chrome | 70, 75 |
Firefox | 60, 68 |
Edge | 17, 18 |
IE | |
Safari | 11, 12 |
iOS Safari | 11.3, 12.0 |
npm install --save safer-eval
Use strict mode
Always use 'use strict'
mode in functions/ files calling saferEval()
.
Otherwise a sandbox breakout may be possible.
'use strict'
const saferEval = require('safer-eval')
function main () {
'use strict' //< alternative within function
const res = saferEval('new Date()')
...
}
Run in worker
Be aware that a
saferEval('(function () { while (true) {} })()')
may run infinitely. Consider using the module from within a worker thread which is terminated after timeout.
Avoid context props
Avoid passing context
props while deserializing data from hostile environments.
context
allows the definition of passed in Objects into the sandbox.
Take care, injected code
can overwrite those passed context props!
Check the tests under "harmful context"!
Parameters
code: String
, a string containing javascript code
context: Object
, define globals, properties for evaluation context
Returns: Any
, evaluated code
Example:
in node:
'use strict' //< NEVER FORGET TO ADD STRICT MODE in file/ function
//< running `saferEval`
const saferEval = require('safer-eval')
const code = `{d: new Date('1970-01-01'), b: new Buffer('data')}`
const res = saferEval(code)
// => toString.call(res.d) = '[object Date]'
// => toString.call(res.b) = '[object Buffer]'
in browser:
'use strict' //< NEVER FORGET TO ADD STRICT MODE in file/ function
//< running `saferEval`
const saferEval = require('safer-eval')
const code = `{d: new Date('1970-01-01'), b: function () { return navigator.userAgent }`
const res = saferEval(code, {navigator: window.navigator})
// => toString.call(res.d) = '[object Date]'
// => toString.call(res.b) = '[object Function]'
// => res.b() = "Mozilla/5.0 (..."
To minimize any harmful code injection carefully select the methods you allow in context
const code = `window.btoa('Hello, world')`
// AVOID passing a GLOBAL context!!!
const res = saferEval(code, {window: window})
// BETTER - code needs only access to window.btoa
const clones = require('clones')
const context = {
window: {
btoa: clones(window.btoa, window)
}
}
const res = saferEval(code ,context)
// => res = 'SGVsbG8sIHdvcmxk'
Use new SaferEval()
to reuse a once created context.
'use strict' //< NEVER FORGET TO ADD STRICT MODE in file/ function
//< running `saferEval`
const { SaferEval } = require('safer-eval')
const safer = new SaferEval()
const code = `{d: new Date('1970-01-01'), b: new Buffer('data')}`
const res = safer.runInContext(code)
FAQs
harmful as eval
The npm package safer-eval receives a total of 10,572 weekly downloads. As such, safer-eval popularity was classified as popular.
We found that safer-eval demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
Security News
As cyber threats become more autonomous, AI-powered defenses are crucial for businesses to stay ahead of attackers who can exploit software vulnerabilities at scale.
Security News
UnitedHealth Group disclosed that the ransomware attack on Change Healthcare compromised protected health information for millions in the U.S., with estimated costs to the company expected to reach $1 billion.