How safe is it to eval() code received from a postMessage event?

Question

I'm sending the code of a javascript function that is defined in the parent document:

var fn = function(){ 
           // code here that is going to be eval'd
         };

$('#iframe').get(0).contentWindow.postMessage(encodeURI(fn.toString()));

to be evaluated in the iframe:

$(window).bind('message', function(e){
  eval('(' + decodeURI(e.originalEvent.data) + ')();');
});

The reason I'm doing this is because I can manage the code easier, because this way all the js is in one file :)

But is it safe?

The only one who can modify the code is the same person on which's computer the code gets evaluated, right?

Useful rule: if you're using `eval()`, you're probably doing something wrong. — Blazemonger, Jun 22 '12 at 18:50

score 4 · Accepted Answer · edited May 23 '17 at 12:07

Apart from the general rule that eval should be avoided if possible, your current code is not secure.

Cross-document messaging is supposed to be a safe technique for cross-origin communication. The most important aspect here is respecting the origins: The sender can decide to which documents of which origin a message may be sent and a receiver can decide of which origins it may accept messages from.

But in your case your sender neither specify the recipient origin nor does the recipient check the sender origin. This is a security weakness as either your sender can send messages to a wrong recipient (your frame’s document changes) or your recipient accepts messages with potential malicious code from a wrong sender (your document is embedded in a malicious page).

So to make your cross-document messaging secure, always specify the sender’s origin within the postMessage call:

otherWindow.postMessage(message, "http://example.org:8080");

And always check the origin when receiving a message:

function receiveMessage(event) {  
    if (event.origin !== "http://example.org:8080") return;
    // ...
}
window.addEventListener("message", receiveMessage, false);

If you’re communicating within the same origin, you can use window.location.origin:

// sender
otherWindow.postMessage(message, window.location.origin);

// recipient
if (event.origin !== window.location.origin) return;

As window.location.origin seems to be available in WebKit only, here’s a workaround:

if (!window.location.hasOwnProperty("origin")) {
    window.location.origin = window.location.protocol + "//" + window.location.host;
}

for some reason passing `window.location.origin` to postMessage is giving me SYNTAX.ERR in Opera — Alex, Jun 23 '12 at 12:18
seems to work with `window.location.protocol + '//' + window.location.host` — Alex, Jun 23 '12 at 12:22
@Alex Yep, that’s what I was just about to recommend to use, too. — Gumbo, Jun 23 '12 at 12:27
@Alex: And `':' + port` if the port isn't the standard port for the protocol. — T.J. Crowder, Apr 30 '14 at 17:48

score 2 · Answer 2 · answered Jun 22 '12 at 18:57

Regarding "safe", you're talking about a window, which is technically under complete control of the user (if the user is savvy enough), communicating with another such window or iframe. So basically it's all under the user's control. It's as safe as anything else on the client, which is to say, nothing is safe on the client; it's the wild west out there. You can't protect the user from himself/herself if the user doesn't want to be protected.

That being said, generally there are better ways to get things done that eval(). Almost always.

score 1 · Answer 3 · edited May 23 '17 at 12:07

1

How safe is it to eval()?

not safe at all.

Why is using the JavaScript eval function a bad idea?

edited May 23 '17 at 12:07

Community

1
1

answered Jun 22 '12 at 18:51

Colin D

5,641
1
23
35

score 0 · Answer 4 · answered Jun 22 '12 at 18:51

0

No, it will be easy to manipulate the code to be executed and other stuff, plus eval is not a good way to get things working

answered Jun 22 '12 at 18:51

Wanderson Silva

1,179
1
17
35

1

If you use chrome, you can use Ctrl+Shift+I, then edit the content. This supposing the attacker knows the flow of your application (simple task by looking into the source) – Wanderson Silva Jun 22 '12 at 18:54
Take a look at the link posted by Colin D – Wanderson Silva Jun 22 '12 at 18:55
2

Yes i know that, but the he is editing the content only on his computer. How does that affect others? – Alex Jun 22 '12 at 18:55
Javascript is client side, the most "cross client" risk you have is if you server does not verify content sent by this javascript code – Wanderson Silva Jun 22 '12 at 18:57
But I do not send anything to the server. It's the other way around: I'm sending the code from the server to the client.. – Alex Jun 22 '12 at 18:58
Ok, it maybe will not be a risk for you and your other clients, just a bad code – Wanderson Silva Jun 22 '12 at 19:00

score 0 · Answer 5 · answered Jun 22 '12 at 18:54

0

Using the eval() function means if any attacker was to inject javascript into your site, he could execute ANY kind of rogue code within the eval function.

answered Jun 22 '12 at 18:54

arijeet

1,858
18
26

4

If he is able to inject JavaScript, he can already do whatever he wants. – Gumbo Jun 22 '12 at 18:56
A client user can hack himself all day. That doesn't make your app unsafe. A javascript client app is *always* at the mercy of the client user. – Jonathan M Jun 22 '12 at 19:08

How safe is it to eval() code received from a postMessage event?

5 Answers5