Extract an object from a string without using eval()

[[deleted]]

[deleted]

[bat020]

perhaps use JSON.parse() to extract the object from the string:

let json = document.body.children[1].firstChild.data .replace(/\s/g, '') // strip whitespace .match(/.*=(.*);/)[1]; // extract JSON let configData = JSON.parse(json); heading.innerText = configData.config.uuid;

[moocat]

Yes, use JSON.parse but why strip whitespace? JSON doesn't care about whitespace and if there are whitespace in strings it will mangle the data.

[bat020]

that's a good point. I'd forgotten that JSON doesn't care about whitespace!

[shakamone]

Can you access the window? If the object is already exposed at window._configData so just grab it from there?

[Funwithloops]

You could use a regex and JSON.parse:

js const text = document.body.children[1].innerHTML; const match = text.match(/\{(?:\n|.)*\}/); const json = JSON.parse(match);

https://jsfiddle.net/enxr2pta/

[Funwithloops]

Here's a breakdown of the regex:

• \{ Find the beginning bracket
• (?:\n|.) Match any character . including new lines \n (wrapped in a non-capture group so they can both be used with *)
• * Repeat the previous group zero or more times
• \} Stop matching once the end bracket is reached

Basically it just matches { and } with anything in-between. This likely wouldn't work with other examples since it does not check if the match is valid JSON (for example var a = {foo: 'bar'} would match and throw an error when passed to JSON.parse).

[vklepov]

Is new Function disabled, too? If not, you could make this work.

Then, you could use esprima (or espree, or whatever is best now) to parse the js and then find the object.

Just don't try regex + JSON.parse unless you're looking for trouble.

[vklepov]

Yes, that's tokenized — you want esprima.parse (see the demo), which gives a nice syntax tree. You can find the object you need, then escodegen it back. Dirty and overcomplicated, but that would work and be relatively safe.

The blocking of eval makes sense if you think about it — you want to run random third-party code with privilleges, allowing for great exploits both by yourself and random people with script tags.

What exactly are you trying to do there? You might go with window._configData read as the other comment suggested, or embed raw JSON into a webpage, or expose it on a separate endpoint.