search

TomFrost / Jexl

Javascript Expression Language: Powerful context-based expression parser and evaluator
MIT License
561 stars 92 forks source link

eval is safe #81

Closed GlauberF closed 4 years ago

GlauberF commented 4 years ago

what is the difference between eval from Jexl, compared to eval from javascript? Second question, is it really safe?

TomFrost commented 4 years ago

Hi Glauber,

The only thing Jexl.eval and Javascript's native eval have in common is the name -- they do two very different things. Javascript's eval() executes javascript code. Jexl parses and evaluates Jexl expressions -- which, while the syntax has many similarities to Javascript, is not actually Javascript.

The safety comes from the fact that, even if you allow an end-user to supply the expression to be evaluated, they will be unable to run code that you do not explicitly supply to Jexl in advance. Even if you add a Javascript object to your context argument, functions it contains cannot be invoked from a Jexl expression. The only code that will run outside of Jexl itself is code that you've added by supplying your own transform function, or binary/unary operators.

So, in short: The safety of Jexl is determined by the custom transforms and operators you add to it. I'd advise strongly against giving Jexl expressions access to functions that can write or modify records in any way, or load data that should be restricted to certain people -- especially if you are processing expressions that users can submit directly, or that might be stored in a file or database that an attacker could try to access.