Is using Javascript eval () 100% safe?

Question

I am writing a PHP library that generates Javascript code.

Javascript code contains several components named component001 , component002 , etc.

Pages are loaded dynamically through AJAX.

I need to pass the component name through a URL variable, which is then omitted () using a script.

The only way to protect what evades is with the regular expression ^component[0-9]{3}$ : if it passes, it will be nullified, otherwise it will not.

For me, this is 100% safe, because nothing will be done if it is just the name of one of my known components, or something in the eval() command that can be used in this code example, for example, regular expression injections, some kinds scripts on different sites, etc.

 window.onload = function() { // *** DEFINED IN ANOTHER JAVASCRIPT FILE: var component001 = 'testing111'; var component002 = 'testing222'; var component003 = 'testing333'; var APP = {}; APP.getUrlVars = function() { var vars = [], hash; var hashes = window.location.href.slice(window.location.href.indexOf('?') + 1).split('&'); for(var i = 0; i < hashes.length; i++) { hash = hashes[i].split('='); vars.push(hash[0]); vars[hash[0]] = hash[1]; } return vars; } APP.getUrlVar = function(name, defaultValue) { defaultValue = (typeof defaultValue == 'undefined') ? '' : defaultValue; var vars = APP.getUrlVars(); if(vars[name] === undefined) { return defaultValue; } else { return vars[name]; } } APP.safeEval = function(nameOfComponent) { var REGEX_VALID_NAME = /^component[0-9]{3}$/; if(REGEX_VALID_NAME.test(nameOfComponent)) { return eval(nameOfComponent); } else { return 'ERROR'; } } // *** JAVASCRIPT FILE LOADED VIA AJAX: var nameOfComponentToDisplay = APP.getUrlVar('compname', 'component001'); var component = APP.safeEval(nameOfComponentToDisplay); document.write(component); } 

Answer 1

There are almost zero reasons to use eval , and I think this is not one of them. Remember that all objects act like dictionaries, so you can just do something like this:

 var components = { component001 : 'testing111', component002 : 'testing222', component003 : 'testing333' }; APP.safeEval = function(nameOfComponent) { var result = components[nameOfComponent]; if(result) { return result; } else { return 'ERROR'; } } 

Answer 2

Well, if everyone has a name, then

  eval(component101) 

does nothing, so it seems safe. Did you mean

  return eval(nameOfComponent + '()'); 

If so, then I don’t understand why you just don’t put your components in a namespace object. Then you will not need eval at all:

  return components[nameOfComponent](); 

If they are not functions, then the same thing applies, but you must leave "()".

Answer 3

If the variables are defined in another javascript file and contain only numbers and letters, then they are part of the global namespace. Thus, they can be accessed as properties of the window object (there is no need for eval !):

 if (typeof window[nameOfComponent] !== 'undefined') return window[nameOfComponent] return 'ERROR';