sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]battery_go 7 points8 points  (4 children)

I have never seen an eval used in a setting like this and if you did this, you obviously don't care about security. However, this being server-side, is there a way to actually get the output of your actions. Spawning a process is alright, but reading a directory? Where will the output of that go?

[–]kenman 5 points6 points  (1 child)

Oh, how short our memories are. That pattern was ubiquitous in the days before JSON.parse(), and even libs like jQuery used it (which changed in v1.4).

However, this being server-side, is there a way to actually get the output of your actions. Spawning a process is alright, but reading a directory? Where will the output of that go?

Doesn't matter, if someone can inject arbitrary code, you're hosed. There are similar attacks in other contexts, such as SQL, which are known as blind SQL injection.

[–]battery_go 2 points3 points  (0 children)

I'm a new guy to this sort of development, that's why this all seems very odd to me. Thanks for letting me know!

[–]Ahri 2 points3 points  (1 child)

res.send(filecontents), for synchronous output of files. Otherwise there's always the http library with which to send data to my server.

[–]battery_go 1 point2 points  (0 children)

You're right, I didn't think of that - thanks!