Question

I need to detect and eval the Javascript code contained in a string.

The following code works, but it only evaluates the first <script>...</script> it founds.

function executeJs(html) {
    var scriptFragment = "<script(.+?)>(.+?)<\/script>";
    match = new RegExp(scriptFragment, "im");
    var matches = html.match(match);
    if (matches.length >= 2) {
        eval(matches[2]);
    }
}

I wonder if there is a method that allows me to iterate and execute all Javascript fragments.

Answer 1

The reason it only takes the first one is because you’re missing the g flag. Try this:

function executeJs(html) {
    var scriptFragment = '<script(.*?)>(.+?)<\/script>';
    var re = new RegExp(scriptFragment, 'gim'), match;
    while ((match = re.exec(html)) != null) {
        eval(match[2]);
    }
}

executeJs('<script>alert("hello")</script>abc<script>alert("world")</script>');