Document.write can be a form of eval

Question

function x(y){document.write('<script src="'+y+'" type="text/javascript"></script>')

Document.write can be a form of eval.

Got this message from jshint any idea how can solve the problem?

See this answer: http://stackoverflow.com/a/15048239/798677 – That Brazilian Guy May 16 '17 at 21:33 — That Brazilian Guy, May 16 '17 at 21:33

score 2 · Answer 1 · answered Feb 23 '14 at 16:48

2

Sure. Don't use document.write.

var s = document.createElement('script');
s.src = y;
document.body.appendChild(s);

answered Feb 23 '14 at 16:48

1

@MildFuzz This code can be used at any time, not just while the page is loading. – Niet the Dark Absol Feb 23 '14 at 16:49
1

You must be using `document.write` elsewhere then. – Niet the Dark Absol Feb 23 '14 at 16:53
Okay, so it has increased versatility, but in security terms, both are the same, right? Both could lead to the execution of malicious code. – Mild Fuzz Feb 23 '14 at 16:53
@MildFuzz True, from a security perspective, however that depends on where `y` comes from exactly. – Niet the Dark Absol Feb 23 '14 at 16:54
It depends just as much for either solution. I guess my point is that, linting and versatility aside, there is nothing "wrong" with how the OP has done it. – Mild Fuzz Feb 23 '14 at 16:58

1 Answers1