How can malicious user input can execute arbitrary code? about static-eval HOT 5 CLOSED

for executing user input, you need a sandbox or a dedicated VM

from static-eval.

But it's not executing any code is it? It's parsing user input into something it can evaluate - but the user can't actually run any code as such? It only evaluates static input.

from static-eval.

yes, "eval" means that it's executing code. if you want to analyse the code instead of executing it, you should take a look at a parser like esprima

from static-eval.

Esprima is required to parse the code for static-eval. It takes the parsed code, and evaluates it based on those expressions. It doesn't ever call eval on any of the code. Is it because of how it handles the FunctionExpression, i.e. using the function constructor?

It seems like a major use case would be for evaluating user provided expressions safely.

from static-eval.

the latest vulnerability, that was only discovered 2 years after the last version was released, showed how it was possible. check the #20 for the advisory with a PoC

from static-eval.