0

I realized a javascript parser built in a web page. A user can put a javascript code in the text-area like:

var i = 0;
i++;
var y = i * 10;
document.write(y);

that is parsed in order to generate some outputs (e.g., document.write stream, and so on).

The function parse is called when textarea change event is generated.

function parse(text) {
    try {
        ....
        eval(text);
    } catch (e) {
        ....
        return {
            status : false, output : ..., ... : ...
        };
    }
    return {
        status : true, output : ...., ... : ...
    };
}

Everything works well but I have problem when a user writes a loop in the text area (e.g., for(var i=0; i<10; ), while(true)) because the application goes in loop.

To avoid this problem, I would ask you all some questions/solutions for this problem:

  1. Are there some javascript libraries or functions that allow to eval a javascript code but are loop-free?
  2. Can I ask to execute my parse function but in a fixed time? After such time I would generate an exception that stops the eval function.
  3. Before to call the eval(text) I can call a checkIfThereAreLoops function that analyses the text seeking for patterns like for(var i=0; i<10; ) or while(true). Is this a good solution? Can I use a regular expression to seek these patterns?
5
  • 1
    Try to avoid eval, it said bad things about you
    – Neil
    Mar 21, 2013 at 9:30
  • why not simply validate the input and forbid (ignore or notify the user) these malicious actions? Mar 21, 2013 at 9:31
  • @EliranMalka — "simply"?!
    – Quentin
    Mar 21, 2013 at 9:33
  • @EliranMalka - the 'simply validation' of the code is something like I described in point 3?
    – jfabrizio
    Mar 21, 2013 at 9:36
  • Can I force the stop of the eval method after a timeout?
    – jfabrizio
    Mar 21, 2013 at 10:56

1 Answer 1

1

If you are trying to see whether arbitrary code will terminate, you will be in for a rough time the Halting Problem is NP-Hard.

So you are right to think that you would either need a preventative measure on your parse function that either times out or dismisses unsafe input.

I'm not aware of a way to interrupt eval without the browser imposing a 'this script is running too long' limit, so you would want to sanitize the input and not evaluate anything with a loop: This will be tricky since you can't just search for constructs such as for, while etc and avoid recursive function calls.

This is a difficult problem to solve...

One 'hacky' solution could be to insert a unique variable declaration into the top of the entered code (hidden of course) and to increment this variable every other line from within the input code (again, hide these insertions and allow for syntax constructs becoming broken. Also insert sanity checks at each increment if unique_var > 99999 exit; (where 99999 is some limit you impose).

This should at least stop infinite loops.

2
  • So I know the halting problem so I'm trying to find an efficient solution to avoid this basic loop. Thus if I have a variable _op_counter = 0 before to call the eval function I can add the code incrementOpCounter() function incrementOpCounter(){ if _op_counter > 99999 throw "There is a loop."; _op_counter++; } to each line I could resolve the problem. The new code before to be parsed is (see example) var i = 0; incrementOpCounter(); i++; incrementOpCounter(); var y = i * 10; incrementOpCounter(); document.write(y); incrementOpCounter();
    – jfabrizio
    Mar 21, 2013 at 10:06
  • But I can have some problem with [if, while, for] without {} but could be a solution...
    – jfabrizio
    Mar 21, 2013 at 10:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.