88314 - Review browser JS for dangerous eval()'s

Status: RESOLVED DUPLICATE of bug 1473549

(Core :: Security, defect, P3)

Description

[Mitchell Stoltz (not reading bugmail)]

As Brendan warned in bug 87980, there may be other places where eval() or new
Function calls may allow the running of unescaped or otherwise dangerous code.
Jesse, please do an lxr search on the calls Brendan mentioned and look for
potentially dangerous usages.

Comment 1

[Jesse Ruderman]

Attachment: patch: replace some evals with parseInt() and new RegExp()

Comment 2

[Brendan Eich [:brendan]]

r/sr=[e-mail], nice.

/be

Comment 3

[Mitchell Stoltz (not reading bugmail)]

r=mstoltz. Let's check it in!

Comment 4

[Jesse Ruderman]

jat checked in the eval fix above for me because I was having trouble checking 
in.  I'll do setTimeout next.  (I didn't get all the evals, since I couldn't 
figure out what it was being used for in every case.)

Comment 5

[Mitchell Stoltz (not reading bugmail)]

Less important bugs retargeted to 0.9.9

Comment 6

[Mitchell Stoltz (not reading bugmail)]

Mozilla1.0

Comment 7

[Alex Vincent [:WeirdAl]]

I was just thinking about eval() in chrome.  Is anyone still interested in this 
bug?

Comment 8

[Daniel Veditz [:dveditz]]

Attachment: Current (8/2004) uses of eval, setInterval, setTimeout

Comment 9

[Brendan Eich [:brendan]]

Search for /."/ (slashes delimit the text to find) in attachment 155057 [details] and you
will find more than a few bogus evals.  The first one is this:

  eval( "gICalLib."+functionToRun+"( calendarEvent, Server )" );

It should be done away with like so:

  gICalLib[functionToRun]( calendarEvent, Server );

And so on for the rest.

/be

Comment 10

[:Gijs (he/him)]

We're taking care of this in bug 1473549 now.