JS How to run code posted by user in a TextArea?

Question

I was wondering how to run JS code posted by a user in the TextArea when he presses button without refreshing the entire page. I want to have a canvas, a TextArea and a button. When the button is pressed, it runs code from the TextArea and then paints stuff on the canvas.

I know how to put the posted code into variable string.

What I don't know is how to run code in that string.

score 2 · Accepted Answer · answered Jul 03 '14 at 16:17

2

You should be able to wrap code in eval() function. It evaluates JavaScript code represented as a string.

Example:

eval(new String("2 + 2")); // returns a String object containing "2 + 2"
eval("2 + 2");             // returns 4

In your case you will need to read code from text area and pass it to eval() it could look something like this:

eval(document.getElementById('textareaid').value);

answered Jul 03 '14 at 16:17

Matas Vaitkevicius

58,075
31
238
265

Thanks for this lightning fast and valuable answer. Exactly what I wanted :) – smutny1221 Jul 03 '14 at 16:19
1

It's kind of unsafe to use eval for something like that, possibly dangerous, although "lightning fast". – Sapphire_Brick Sep 03 '19 at 22:03
@RaphaelSpoerri Hi, could you give me an example of vulnerability by using JS eval, please. – Matas Vaitkevicius Sep 04 '19 at 05:22
@RaphaelSpoerri So how would one do an XSS attack using JS eval? – Matas Vaitkevicius Sep 09 '19 at 16:59
1

[Stack overflow: why is eval bad?](https://stackoverflow.com/questions/86513/why-is-using-the-javascript-eval-function-a-bad-idea) – Sapphire_Brick Sep 09 '19 at 23:04
@RaphaelSpoerri Doesn't say anything about XSS. – Matas Vaitkevicius Sep 10 '19 at 06:55
@RaphaelSpoerri Yeah, the top answer is out of date, also the question is `loaded`. So if one cannot do XSS otherwise it would be in the answers of `eval bad` question, what other vulnerabilities does `eval` expose you to? – Matas Vaitkevicius Sep 10 '19 at 18:24
1

The simplest problem can result when not being careful with interfaces that involve eval. I don't know so much about XSS though, the XSS problem is just what I heard. – Sapphire_Brick Sep 10 '19 at 18:27

score 0 · Answer 2 · answered Jul 03 '14 at 16:18

0

If it is HTML just send it to a variable with a submit button and than document.write("variable").

answered Jul 03 '14 at 16:18

Andrew

995
6
10

He said **without** refreshing the entire page, what document.write inevitably does. – Sapphire_Brick Sep 03 '19 at 22:02

score 0 · Answer 3 · answered Sep 03 '19 at 22:00

The safest and simplest way to do it that I know is with node.js:

function runStr (i){
    var vm = require ('vm');
    var box = {};
    vm.createContext(box);
    vm.runInContext(`prgm = function(){return ${i};}`, box);
    return box.prgm();
}
console.log(runStr("2 + 2")); // 4

JS How to run code posted by user in a TextArea?

3 Answers3