Run JavaScript code independent inside JavaScript?

Question

Is there a way in JavaScript in browsers, to run an other script stored as string independently from the main JavaScript and also get the console output from that script in a way that it is not (just) printed to the console?

Basically I want something like this:

var script = 'console.log("Hello World");'

var consoleOut = script.runAsJS();

Does this answer your question? [How do I load a javascript file dynamically?](https://stackoverflow.com/questions/5235321/how-do-i-load-a-javascript-file-dynamically) — Jay, Jul 07 '20 at 09:51
Possible duplicate of [Execute JavaScript code stored as a string](https://stackoverflow.com/questions/939326/execute-javascript-code-stored-as-a-string) — Karan, Jul 07 '20 at 09:59
@Karan It was already posted as answer and it isn't independent and also doesn't give the console — user11914177, Jul 07 '20 at 10:01
Is this what you're looking for? https://stackoverflow.com/questions/46417440/how-to-get-console-log-output-from-eval — Leaf the Legend, Jul 07 '20 at 10:03

gkucmierz · Answer 1 · 2020-07-07T09:57:05.340

3

What environment?

In browser, you can use web workers.

In Node/Deno you can use VM or spawn separate process.

edited Jul 07 '20 at 09:57

answered Jul 07 '20 at 09:53

gkucmierz

1,055
1
9
26

Thanks, I added this to response – gkucmierz Jul 07 '20 at 09:57
And I added the answer to the question – user11914177 Jul 07 '20 at 09:58

Leaf the Legend · Accepted Answer · 2020-07-07T10:45:12.090

0

Maybe you could look into eval()

Hopefully this is what you mean by 'independent from the main javascript'. If you mean as in variables from the outer scope will not be defined in the string, eval() will not work for you. It is treated as part of the same program.

Edit: also see this answer on specifying the scope of eval()

If you want to store the console.log in a variable, try something like this:

var script = 'console.log("Hello World");'
var consoleOut = [];
script = script.replace(/console\.log/g,"consoleOut.push");
eval(script);

Edit: as suggested by comments, eval is often not the best in terms of security. A more efficient and secure option may be Function, however the docs mention that Function still suffers from security issues:

var script = 'console.log("Hello World");'
var consoleOut = [];
scriptFunction = new Function(script.replace(/console\.log/g,"consoleOut.push"));
scriptFunction();

edited Jul 07 '20 at 10:45

answered Jul 07 '20 at 09:53

Leaf the Legend

471
3
9

in what way _is_ `eval` independent? – robertklep Jul 07 '20 at 09:57
Well I want that kind of independence and also I want to separately get the console outputs – user11914177 Jul 07 '20 at 09:59
Ah I see what you mean now – Leaf the Legend Jul 07 '20 at 10:00
1

Since your script is stored as a string, what if you were to `.replace` all `console.log`s with a custom function that returns the value you want? – Leaf the Legend Jul 07 '20 at 10:06
Cool. Glad I could help – Leaf the Legend Jul 07 '20 at 10:17
1

@user11914177 The use of `eval()` is not advised for most use cases. Often there is a better solution. If you can explain in more detail what you want to achieve we can help you with a better solution. See: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#Never_use_eval! – Mark Baijens Jul 07 '20 at 10:26
Yes, eval can definitely be dangerous – Leaf the Legend Jul 07 '20 at 10:31
Depends on the use case – Leaf the Legend Jul 07 '20 at 10:31
@MarkBaijens thanks for that warning, this site references the `Function` is this now safe to use or is it still possible to exploit it? – user11914177 Jul 07 '20 at 10:37
@user11914177 It's definitely safer to use the function wrapper, I'm not an expert on this area but I think it's still dangerous because it still uses code injection. Therefore if you are not 100% in control of the code that is inserted then you still have security issues. It's a bit like SQL injection. – Mark Baijens Jul 07 '20 at 11:07

Karan · Answer 3 · 2020-07-07T10:18:29.410

0

To run an other script stored as string you can use eval() as suggested by answer from @Leaf the Legend. And for script to run independently from the main JavaScript you can use IIFE.

So combining eval and IIFE you may get your desired result. Like (function() { eval(script) })();

Below is small snippet which may elaborate better.

// variable from global scope.
let a = 10;

function runAsJS(script) {
  (function() {
    eval(script)
  })();
}

let script = `
  let a = 10; 
  a += 10;
  console.log('a from eval script', a);`;

runAsJS(script);
console.log('a from global scope', a);

edited Jul 07 '20 at 10:18

answered Jul 07 '20 at 10:13

Karan

12,059
3
24
40

Well that just is Leaf the Legends answer – user11914177 Jul 07 '20 at 10:14
No, for `eval` yes, but I have suggest to use `IIFE` which can make difference and variable defined inside `script` will have limited scope to itself only. It will not affect global variables. – Karan Jul 07 '20 at 10:16

Run JavaScript code independent inside JavaScript?

3 Answers3