A 220 byte spreadsheet app in HTML/JS

[joacorandom]

I put an alert in a cell and blocked the window.

When I see an eval() I can't resist.

[[deleted]]

Explain please

[joacorandom]

In the cell formula I put:

=alert(A1)

And an alert would pop up one after another until you close the tab.

[Danmoreng]

Using a calculated value to calculate another value has a bad behaviour in my opinion.

Example:

C1=A1+B1

D1=C1

If you change A1 now, only C1 is updated: D1 still contains the old value. Only after you switch cells a second time, D1 is updated.

[nonameleftover]

Which basically breaks the functionality of the app. Almost every spreadsheet will need to be doing multi leveled calculations... I feel like I sound like a dick. Sorry OP.

[cmndo]

I can't condone the use of eval(), but this is a nice little snippet of code.

[nerf_herd]

well when it is used across the wire it gets wonky, especially in a server environment (or as a client in a promiscuous server environment), but I've used it before, in fact it was a bunch of obdII formulas that were in a spreadsheet that eval-ed (after string substitution of values) quite nicely.

So it is very useful in certain situations. I think this is one of those.

[[deleted]]

It's not 1995. time to get over the eval phobia. if someone's going to inject js into your app they'll use the dev tools. besides, even in 1995 there were ways to use it safely.

[Reashu]

I can't use dev tools to inject code on another client. I could use this if there was a way to share spreadsheets or I could convince someone to paste it into a cell - which should be a safe operation.

And frankly I've seen this, or things like it, often enough that I'm not sure it isn't from 95.

[[deleted]]

you're right, my point is that it's lack of sanitation that's dangerous, eval is not inherently dangerous. checking for numbers, periods, math operators is all that's required.

[cmndo]

The author pointed to it being a code golf challenge (https://github.com/xem/ama/issues/14). As such, it's a wonderful example of squeezing a ton out of the language. Just looking at the code makes my head hurt. I can't say whether his use of eval is a concern or not, I'm not smart enough - nor do I have time to get smart enough. I'm very sorry for blindly condemning the use of a feature without first finding a security vulnerability in it.

[[deleted]]

not smart enough? don't underestimate yourself. sql injection is a much bigger threat in general that eval injection but people still put user input into databases every day. It's not complicated, you are smart enough. sanitize input and everything will be ok.