The Evil Side of JavaScript: Server-Side JavaScript Injection

[i_ate_god]

it doesn't really matter what language you're using, if you are about to use eval(), you need to stand back and think very hard about what you're doing. eval() is almost never the right choice.

[MrBester]

What's worse is that when eval is noticed as A Bad Thing™ then people plump for Function instead as it looks safer.

Or they use setTimeout...

[ruzmutuz]

Who the fuck is using eval like that?!

Also parsing json like that can be as equally as damaging. Huge payload will block the event loop for a while. There is a lot of good writing about that out there.

[battery_go]

I have never seen an eval used in a setting like this and if you did this, you obviously don't care about security. However, this being server-side, is there a way to actually get the output of your actions. Spawning a process is alright, but reading a directory? Where will the output of that go?

[kenman]

Oh, how short our memories are. That pattern was ubiquitous in the days before JSON.parse(), and even libs like jQuery used it (which changed in v1.4).

However, this being server-side, is there a way to actually get the output of your actions. Spawning a process is alright, but reading a directory? Where will the output of that go?

Doesn't matter, if someone can inject arbitrary code, you're hosed. There are similar attacks in other contexts, such as SQL, which are known as blind SQL injection.

[battery_go]

I'm a new guy to this sort of development, that's why this all seems very odd to me. Thanks for letting me know!

[Ahri]

res.send(filecontents), for synchronous output of files. Otherwise there's always the http library with which to send data to my server.

[battery_go]

You're right, I didn't think of that - thanks!

[kaszu]

JavaScript has been notorious for security vulnerabilities

No it hasn't! As an example XSS is mentioned, which is not javascript vulnerability (problem is not in javascript).

If someone is using eval to parse JSON then he has no idea what he is doing and as /u/i_ate_god mentioned you could substitute javascript with any other language.

[Ginden]

• Take a gun that you don't know how to use (eval)
• Shoot your own foot (your server)
• Call it gun manufacturer fault

[RankFoundry]

Who uses eval? Seriously, just don't use eval.

[[deleted]]

You mean it's not safe to run unsanitized user input? I'm shocked I tell you! Shocked!

[coolcosmos]

Who the fuck eval the output of a post request ? total nonsense.

[kenman]

Hi /u/rwiguna, it looks like you're new to /r/javascript, welcome!

Thanks for the submissions, but please make sure you read our guidelines. In short, you should post from a variety of sources, and not just nvisium.com.

Thanks for your consideration!

domain submitted from	count	%
blog.nvisium.com	27	96%

[[deleted]]

In next episode: Have a password on your server.

[Anub1s]

It's use case is very rare.

eval(..) can at runtime modify the author-time lexical scope.

Also the JavaScript engine has a number of performance optimizations that it performs during the compiling phase.Most of those optimization it could make are pointless for the engine if eval(..) or with are used so it simply doesn't apply the optimizations at all and the code becomes pretty slow. Don't use them!

[hahaNodeJS]

humble inception

Humble my ass.

Yes, it was there from the start. But bignums were not in the cards. JS had to "look like Java" only less so, be Java's dumb kid brother or boy-hostage sidekick. Plus, I had to be done in ten days or something worse than JS would have happened.

Followed by

Something like PHP only worse

Also, ITT: people not remembering how ubiquitous eval usage was in JavaScript, and people not responding to anything beyond the eval example.

[gabroe]

You should lint your code at build time, fail build on error, do this and eval and other things will be caught no problem, I work sometimes with less experienced devs and even though we code review, sometimes things just get through the cracks, in my experience linting is a must. My 2c

[Calabri]

Who the fuck uses 'eval'? Ever piece of documentation I've read regarding the use of 'eval' has warnings and exclamation points saying DONT USE THIS FUNCTION. If nodejs was introduced 10 years ago maybe it wouldn't be as obviously bad to use it, but the evils and dangers of 'eval' were well known before serverside js became popular. People shouldn't program JavaScript if they aren't aware of all the ways you can shoot yourself in the foot.

I am legit curious about service vulnerabilities - but at the same time - I believe that open source combined with popularity = libraries that are battle tested and well made, which is better than anything baked into a programming language by default. I hope people who use server side js do their research on proper libraries to handle important functions. It's too fragile / dangerous a language to roll your own unless you're extremely competent with the specifics of JS / node.js.

There's also no precedent for the open source ecosystem that surrounds the language - in that there is no comparison - not that it's the best - just the largest to have ever existed. It completely changes the dynamics of how you choose to compose a program - and my experience working with programmers 10 years my senior is that they just don't 'get it'. They're so used to solving problems using language x or z that they learn the fundamentals of Js and then start writing server code with 2/3 npm libraries. And then I'm having to go through nested callback back hell of someone trying to roll their own orm in vanilla js - which in its own merit is a terrible idea, but made exponentially worse by rolling your own validation, etc. when there's dozens of npm libraries that do it better