Skip to content

Commit

Permalink
docu: THIS MODULE IS HARMFUL
Browse files Browse the repository at this point in the history
  • Loading branch information
commenthol committed Dec 6, 2019
1 parent 6d5ed4b commit fe26316
Show file tree
Hide file tree
Showing 5 changed files with 21 additions and 55 deletions.
29 changes: 20 additions & 9 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,19 +1,30 @@
# safer-eval
# safer-eval but harmful

[![NPM version](https://badge.fury.io/js/safer-eval.svg)](https://www.npmjs.com/package/safer-eval/)

> a safer eval
> harmful as eval
A safer approach for eval in node and browser. Before using this module, **ask
yourself if there are no better options** than using saferEval.
It is potentially better than the bad old `eval()` but still has some harmful potential.
Especially when it comes to passing `context` props.
Use [clones][] to wrap-up the methods you like to allow.
This approach has proven to be HARMFUL and does not suit as repacement for eval in node and browser.
Before using this module, **ask yourself if there are no better options** than using saferEval.
It is potentially better than the bad old `eval()` but has harmful potential.
Checkout the "harmful context" tests section.

![warning](https://raw.githubusercontent.com/commenthol/safer-eval/master/warning.png)
![harmful](https://raw.githubusercontent.com/commenthol/safer-eval/master/harmful.png)

**Warning:** The `saferEval` function may be harmful - so you are warned!
**Warning:** The `saferEval` function is harmful - so you are warned!

Better packages:

- For node check [vm2](https://www.npmjs.com/package/vm2).

----

If you like to **post exploits** you found on this module, feel free to do so.
Please file an issue with your findings.

Maybe this helps then others to build a better sandbox.

----

In node the `vm` module is used to sandbox the evaluation of `code`.

Expand Down
Binary file added harmful.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
2 changes: 1 addition & 1 deletion package.json
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"name": "safer-eval",
"version": "1.3.5",
"description": "a safer eval",
"description": "harmful as eval",
"keywords": [
"eval",
"safe"
Expand Down
Binary file removed warning.png
Binary file not shown.
45 changes: 0 additions & 45 deletions warning.svg

This file was deleted.

0 comments on commit fe26316

Please sign in to comment.