Question

What I’m doing is creating a truth table generator. Using a function provided by the user (e.g. a && b || c), I’m trying to make JavaScript display all combinations of a, b and c with the result of the function.

The point is that I’m not entirely sure how to parse the function provided by the user. The user could namely basically put everything he wants in a function, which could have the effect of my website being changed etc.

eval() is not secure at all; neither is new Function(), as both can make the user put everything to his liking in the function. Usually JSON.parse() is a great alternative to eval(), however functions don’t exist in JSON.

So I was wondering how I can parse a custom boolean operator string like a && b || c to a function, whilst any malicious code strings are ignored. Only boolean operators (&&, ||, !) should be allowed inside the function.

Answer 1

Even if you check for boolean expressions, I could do this:

(a && b && (function() { ruinYourShit(); return true; })())

This is to illustrate that your problem is not solvable in the general case.

To make it work for your situation, you’d have to impose severe restrictions on variable naming, like requiring that all variables are a single alphabet letter, and then use a regular expression to kick it back if anything else is found. Also, to “match” a boolean expression, you’d actually have to develop a grammar for that expression. You are attempting to parse a non-regular language (javascript) and therefore you cannot write a regular expression that could match every possible boolean expression of arbitrary complexity. Basically, the problem you are trying to solve is really, really hard.

Assuming you aren’t expecting the world to come crashing down if someone ruins your shit, you can develop a good enough solution by simply checking for the function keyword, and disallowing any logical code blocks contained in { and }.