Remove eval() calls about reqwest HOT 8 CLOSED

If you are interested, I will fork your repo, fix a few things and make a pull request so that you can distribute my changes.

Let me know.

from reqwest.

eval is not bad if it's your own website and data

from reqwest.

This is no response. Eval is bad even if it's your own website and data.

Consider a website sending data to the backend service and the service including the request or part of it in the response in order to be processed on the UI side. Someone malicious could forge a request that could end up being evaluated if proper care wasn't taken (i.e. making sure reqwest won't eval and encoding everything that came from the user). Browse around, there are tons of such websites. Using eval adds a risk for cross-site scripting.

Think about it.

from reqwest.

If you're using JSON responses, just make sure you have a window.JSON object, use a polyfill for older browsers, and eval() won't be invoked. If you're using Reqwest in Ender then include ender-json in your build and the world will be at peace.

If you're using JS responses and don't like eval() then stop using JS or give it a different type and handle responseText yourself. JS over AJAX isn't ideal anyway.

from reqwest.

Oh, I'm definitely not sending JS from the server. I'm just stating the fact that code can be injected and executed through the eval().

from reqwest.

caveat emptor

from reqwest.

sorry if the response was terse. as @rvagg explained, there are simple ways around it and it's used as the last resort

from reqwest.

Oh I'm aware of the proper ways to do ajax. However, in your library, 'JS' is absolutely not "last resort" as your it uses it by DEFAULT. This is the complete opposite of last resort. Make the web safer by preventing inexperienced developers make silly mistakes like that.

If you feel the 'JS' type can be useful for some people, by all means keep it, but it should definitely not be the default. Furthermore, the 'JSON' type should not default to a simple 'eval()' call in case of a browser without native JSON parser (an alternative solution is use a JSON parser lib like crockford's).

There is a reason why JSON parsers exist in the first place.

This is my professional opinion. Take it or leave it.

from reqwest.