20% of all Node.js modules found vulnerable to injection attacks

Re:20% of all Node.js modules found vulnerable to injection ... by ScottBurson on Monday March 12, 2018 @07:10PM (#16572524)

As someone with almost 40 years of Lisp experience, I firmly believe that the only correct place to call 'eval' is in the implementation of a REPL. For any other purpose that you might be tempted to use it for, there is a better way, that is not only more correct but also faster. Usually, the better way is to pass a function to be called rather than an expression to be evaluated.

There are more legitimate uses of 'exec', of course, but one still needs to be very careful with it. If there really are Node modules that pass their input to 'exec', that strikes me as very poor design.

[ Parent | on HN ]

Re:20% of all Node.js modules found vulnerable to injection ... by kazinator on Tuesday March 13, 2018 @09:31PM (#16581519)

> the only correct place to call 'eval' is in the implementation of a REPL.

Don't forget also: if you're reading uncompiled code from a file, that's an occasion for eval.

[ Parent | on HN ]

Re:20% of all Node.js modules found vulnerable to injection ... by ScottBurson on Thursday March 15, 2018 @04:37PM (#16596326)

There are a handful of other valid uses, but there are many invalid ones. I recall, a couple of years ago, hearing about a Rails vulnerability caused by some API method calling 'eval' on one of its arguments if it happened to be a string, just as a convenience for some use case. The fact that it did so wasn't even documented. I was left with the impression that most programmers don't understand how to use 'eval', or rather, how and why not to use it.

[ Parent | on HN ]