Skip to content

Commit fe26316

Browse files
committed
docu: THIS MODULE IS HARMFUL
1 parent 6d5ed4b commit fe26316

File tree

5 files changed

+21
-55
lines changed

5 files changed

+21
-55
lines changed

README.md

Lines changed: 20 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,30 @@
1-
# safer-eval
1+
# safer-eval but harmful
22

33
[![NPM version](https://badge.fury.io/js/safer-eval.svg)](https://www.npmjs.com/package/safer-eval/)
44

5-
> a safer eval
5+
> harmful as eval
66
7-
A safer approach for eval in node and browser. Before using this module, **ask
8-
yourself if there are no better options** than using saferEval.
9-
It is potentially better than the bad old `eval()` but still has some harmful potential.
10-
Especially when it comes to passing `context` props.
11-
Use [clones][] to wrap-up the methods you like to allow.
7+
This approach has proven to be HARMFUL and does not suit as repacement for eval in node and browser.
8+
Before using this module, **ask yourself if there are no better options** than using saferEval.
9+
It is potentially better than the bad old `eval()` but has harmful potential.
1210
Checkout the "harmful context" tests section.
1311

14-
![warning](https://raw.githubusercontent.com/commenthol/safer-eval/master/warning.png)
12+
![harmful](https://raw.githubusercontent.com/commenthol/safer-eval/master/harmful.png)
1513

16-
**Warning:** The `saferEval` function may be harmful - so you are warned!
14+
**Warning:** The `saferEval` function is harmful - so you are warned!
15+
16+
Better packages:
17+
18+
- For node check [vm2](https://www.npmjs.com/package/vm2).
19+
20+
----
21+
22+
If you like to **post exploits** you found on this module, feel free to do so.
23+
Please file an issue with your findings.
24+
25+
Maybe this helps then others to build a better sandbox.
26+
27+
----
1728

1829
In node the `vm` module is used to sandbox the evaluation of `code`.
1930

harmful.png

27.2 KB
Loading

package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"name": "safer-eval",
33
"version": "1.3.5",
4-
"description": "a safer eval",
4+
"description": "harmful as eval",
55
"keywords": [
66
"eval",
77
"safe"

warning.png

-16 KB
Binary file not shown.

warning.svg

Lines changed: 0 additions & 45 deletions
This file was deleted.

0 commit comments

Comments
 (0)