Question

I’ve got a perfectly correct Json string which gets parsed inside a function’s method by using the eval function. When that is done, though, for some unknown reason the first line of a globally defined method is injected inside as one of the array’s parameters.

the string being parsed is:

{“id”:1,”name”:”object1″,”volume”:15,”weight”:100}

The parsing line is:

var decoded = eval(‘(‘ + encoded + ‘)’);

Once decoded by using the eval() function, I’ve got the “complementary” attribute decoded[‘replaceNode’] inside, which contains a global scope function contained inside another file.

I’d consider it a bug, but since the same happens in both firefox and safari, it seems unlikely. More probably I’ve misunderstood the purpose of eval.

Thank you for your help in advance.

Answer 1

Don’t use eval.

Eval is unsafe and can make attackers execute arbitrary code. Use a JSON library instead.