File tree Expand file tree Collapse file tree 5 files changed +21
-55
lines changed
Expand file tree Collapse file tree 5 files changed +21
-55
lines changed Original file line number Diff line number Diff line change 1- # safer-eval
1+ # safer-eval but harmful
22
33[ ![ NPM version] ( https://badge.fury.io/js/safer-eval.svg )] ( https://www.npmjs.com/package/safer-eval/ )
44
5- > a safer eval
5+ > harmful as eval
66
7- A safer approach for eval in node and browser. Before using this module, ** ask
8- yourself if there are no better options** than using saferEval.
9- It is potentially better than the bad old ` eval() ` but still has some harmful potential.
10- Especially when it comes to passing ` context ` props.
11- Use [ clones] [ ] to wrap-up the methods you like to allow.
7+ This approach has proven to be HARMFUL and does not suit as repacement for eval in node and browser.
8+ Before using this module, ** ask yourself if there are no better options** than using saferEval.
9+ It is potentially better than the bad old ` eval() ` but has harmful potential.
1210Checkout the "harmful context" tests section.
1311
14- ![ warning ] ( https://raw.githubusercontent.com/commenthol/safer-eval/master/warning .png )
12+ ![ harmful ] ( https://raw.githubusercontent.com/commenthol/safer-eval/master/harmful .png )
1513
16- ** Warning:** The ` saferEval ` function may be harmful - so you are warned!
14+ ** Warning:** The ` saferEval ` function is harmful - so you are warned!
15+
16+ Better packages:
17+
18+ - For node check [ vm2] ( https://www.npmjs.com/package/vm2 ) .
19+
20+ ----
21+
22+ If you like to ** post exploits** you found on this module, feel free to do so.
23+ Please file an issue with your findings.
24+
25+ Maybe this helps then others to build a better sandbox.
26+
27+ ----
1728
1829In node the ` vm ` module is used to sandbox the evaluation of ` code ` .
1930
Original file line number Diff line number Diff line change 11{
22 "name" : " safer-eval" ,
33 "version" : " 1.3.5" ,
4- "description" : " a safer eval" ,
4+ "description" : " harmful as eval" ,
55 "keywords" : [
66 " eval" ,
77 " safe"
Load Diff This file was deleted.
You can’t perform that action at this time.
0 commit comments