Use eval instead of JSON.parse #68

arthurdarcet · 2019-09-10T15:14:04Z

This handles:

trailing commas on the last line of array/objects
no need to use quotes around object keys
makes it possible to use "new Date()" in a query to have it return the current time

This handles: - trailing commas on the last line of array/objects - no need to use quotes around object keys - makes it possible to use "new Date()" in a query to have it return the current time

spatecon · 2023-03-13T09:16:23Z

Using eval on server side for this type of logic is overkill.
It can lead to exploits, allowing not only the use of new Date(), but also file I/O and SSRF.

Here's an example.

arthurdarcet and others added 3 commits September 10, 2019 17:13

Use eval instead of JSON.parse

869ae2d

This handles: - trailing commas on the last line of array/objects - no need to use quotes around object keys - makes it possible to use "new Date()" in a query to have it return the current time

fix dist

8759b7b

lastIndexOf instead of indexOf for the closing parenthesis

100b9c8

arthurdarcet force-pushed the patch-1 branch from 880e71e to 100b9c8 Compare September 10, 2019 15:43

Add ObjectID to the eval namespace

eb42784

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Use eval instead of JSON.parse #68

Use eval instead of JSON.parse #68

arthurdarcet commented Sep 10, 2019

spatecon commented Mar 13, 2023 •

edited

Loading

Use eval instead of JSON.parse #68

Are you sure you want to change the base?

Use eval instead of JSON.parse #68

Conversation

arthurdarcet commented Sep 10, 2019

spatecon commented Mar 13, 2023 • edited Loading

spatecon commented Mar 13, 2023 •

edited

Loading