Live data from Hacker News

20% of all Node.js modules found vulnerable to injection attacks

blog.acolyer.org

41–42 of 42 posts

Re: 20% of all Node.js modules found vulnerable to injection attacks

#41
post #3

This headline is entirely false - 20% of Node modules use 'eval' or 'exec'. While these are certainly less secure and a strong secure coding standard would probably ban them or at least reduce their use, it's entirely possible to use both in safe ways.

As someone with almost 40 years of Lisp experience, I firmly believe that the only correct place to call 'eval' is in the implementation of a REPL. For any other purpose that you might be tempted to use it for, there is a better way, that is not only more correct but also faster. Usually, the better way is to pass a function to be called rather than an expression to be evaluated. There are more legitimate uses of 'ex…

> the only correct place to call 'eval' is in the implementation of a REPL.

Don't forget also: if you're reading uncompiled code from a file, that's an occasion for eval.

Re: 20% of all Node.js modules found vulnerable to injection attacks

#42

Earlier quoted context omitted.

As someone with almost 40 years of Lisp experience, I firmly believe that the only correct place to call 'eval' is in the implementation of a REPL. For any other purpose that you might be tempted to use it for, there is a better way, that is not only more correct but also faster. Usually, the better way is to pass a function to be called rather than an expression to be evaluated. There are more legitimate uses of 'ex…

> the only correct place to call 'eval' is in the implementation of a REPL. Don't forget also: if you're reading uncompiled code from a file, that's an occasion for eval .

There are a handful of other valid uses, but there are many invalid ones. I recall, a couple of years ago, hearing about a Rails vulnerability caused by some API method calling 'eval' on one of its arguments if it happened to be a string, just as a convenience for some use case. The fact that it did so wasn't even documented. I was left with the impression that most programmers don't understand how to use 'eval', or rather, how and why not to use it.
Post reply on HN