convert a string containing boolean values to a boolean

Question

If I have this ;

  var a = "(true && false) && true && false"

And if I want to evaluate this string , what are the options ?

If I say, this code will be generated in the browser but there will be absolutely no user input in it , would it be safe to use eval ?

If not, what is the most performant way of parsing it ?

EDIt :

By the way, the string is dynamic , so I can't gaurantee that it's always like above , so it could be :

  var a = "(true && false) || (true && (true && false)) && true && false"

FIY : I know I can use eval, all I'm asking is, why I shouldn't use eval, or is there any other options?

EDIT : the original problem :

 var a = function(){ return false} // all of them always return a boolean
 var b = function(){ return true}
 var c = function(){ return true}
 var d = function(){ return false}

 var conditions = "(a && b) && c && d"

I can't change the above code , I need to parse it, I need the condition to be evaluated ;

Afaik, eval isn't fully safe, hovewer I highly doubt there is a different way to deal with this. — kind user, Apr 11 '17 at 11:14
@RajshekarReddy: why would you do that? That doesn't help in any way. — Cerbrus, Apr 11 '17 at 11:16
You need to `eval()`, I don't think there's any other way if you want to stick to this — Mr. Alien, Apr 11 '17 at 11:16
@Milad: Why do you _need_ to use a string like that? What are you trying to do? I'm sure there's a way to do with you want if you don't stick to building a werd string like that. — Cerbrus, Apr 11 '17 at 11:17
@RajshekarReddy that is still a string, you need to use `eval()` — Mr. Alien, Apr 11 '17 at 11:17
@str , this code is generated by a third party for a very complex rule system where rules are defined with numbers ( 1 && 2 ) and each number points to a function that returns a boolean , and eventually you end up having a string of booleans — Milad, Apr 11 '17 at 11:18
@Milad: can you "get" these numbers instead? What does that third party return? Do you have access to those functions you mention? — Cerbrus, Apr 11 '17 at 11:19

score 2 · Answer 1 · answered Apr 11 '17 at 11:34

2

function ExecuteJavascriptString() {
    var n = 0;
    var s = "(true || false) || (true || (true || false)) && true";
    var ifstate = " if (" + s + ") { console.log('done'); } ";
    setTimeout(ifstate, 1);
}

ExecuteJavascriptString()

answered Apr 11 '17 at 11:34

source: http://stackoverflow.com/questions/939326/execute-javascript-code-stored-as-a-string – Apr 11 '17 at 11:35
2

http://stackoverflow.com/questions/11684558/difference-between-eval-and-settimeout-execute-string-code This is probably as evil as `eval`. – Arg0n Apr 11 '17 at 11:38
1

But hang on, isn't this the same as eval though ? I could still put malicious code inside this string and run it right ? – Milad Apr 11 '17 at 11:38

score 0 · Answer 2 · answered Apr 11 '17 at 12:02

I was thinking maybe you can atleast verify that the string contains what you think it should contain, before running eval on it, using the RegExp /(?:(?:true)|(?:false)|(?:&&)|(?:\|\|)|[()\s])/g:

var validExp = "(true && false && true) || (true && (true && false)) && true";
var evilExp = "(true && false && true) || (true && (true && false)) && true function() { console.log('do evil stuff'); }";

console.log(evalBoolStr(validExp)); //false
console.log(evalBoolStr(evilExp)); //Invalid input

function evalBoolStr(str) {
  if(str.match(/(?:(?:true)|(?:false)|(?:&&)|(?:\|\|)|[()\s])/g).join('') === str) {
    return eval(str);
  }
  return 'Invalid input';
}

Arg0n · Answer 3 · 2017-04-11T14:04:03.850

An attempt at actually writing a parser for boolean strings:

function parseBoolStr(str) {
  var expressions = {};
  var expressionRegex = new RegExp("\\((?:(?:!*true)|(?:!*false)|(?:&&)|(?:\\|\\|)|\\s|(?:!*\\w+))+\\)");
  var expressionIndex = 0;
  str = str.trim();
  while (str.match(expressionRegex)) {
    var match = str.match(expressionRegex)[0];
    var expression = 'boolExpr' + expressionIndex;
    str = str.replace(match, expression);
    match = match.replace('(', '').replace(')', '');
    expressions[expression] = match;
    expressionIndex++;
  }
  return evalBoolStr(str, expressions);
}

function evalBoolStr(str, expressions) {
  var conditions = str.split(' ');
  if (conditions.length > 0) {
    var validity = toBoolean(conditions[0], expressions);
    for (var i = 1; i + 1 < conditions.length; i += 2) {
      var comparer = conditions[i];
      var value = toBoolean(conditions[i + 1], expressions);
      switch (comparer) {
        case '&&':
          validity = validity && value;
          break;
        case '||':
          validity = validity || value;
          break;
      }
    }
    return validity;
  }
  return 'Invalid input';
}

function toBoolean(str, expressions) {
  var inversed = 0;
  while (str.indexOf('!') === 0) {
    str = str.replace('!', '');
    inversed++;
  }
  var validity;
  if (str.indexOf('boolExpr') === 0) {
    validity = evalBoolStr(expressions[str], expressions);
  } else if (str == 'true' || str == 'false') {
    validity = str == 'true';
  } else {
    validity = window[str]();
  }
  for (var i = 0; i < inversed; i++) {
    validity = !validity;
  }
  return validity;
}

var exp1 = "(true && true || false) && (true || (false && true))";
var exp2 = "(true && false) && true && false";
var exp3 = "(true && !false) && true && !false";
var exp4 = "(a && b) && c && d";

console.log(exp1 + ' = ' + parseBoolStr(exp1));
console.log(exp2 + ' = ' + parseBoolStr(exp2));
console.log(exp3 + ' = ' + parseBoolStr(exp3));
console.log(exp4 + ' = ' + parseBoolStr(exp4));

function parseBoolStr(str) {
  var expressions = {};
  var expressionRegex = new RegExp("\\((?:(?:!*true)|(?:!*false)|(?:&&)|(?:\\|\\|)|\\s|(?:!*\\w+))+\\)");
  var expressionIndex = 0;
  str = str.trim();
  while (str.match(expressionRegex)) {
    var match = str.match(expressionRegex)[0];
    var expression = 'boolExpr' + expressionIndex;
    str = str.replace(match, expression);
    match = match.replace('(', '').replace(')', '');
    expressions[expression] = match;
    expressionIndex++;
  }
  return evalBoolStr(str, expressions);
}

function evalBoolStr(str, expressions) {
  var conditions = str.split(' ');
  if (conditions.length > 0) {
    var validity = toBoolean(conditions[0], expressions);
    for (var i = 1; i + 1 < conditions.length; i += 2) {
      var comparer = conditions[i];
      var value = toBoolean(conditions[i + 1], expressions);
      switch (comparer) {
        case '&&':
          validity = validity && value;
          break;
        case '||':
          validity = validity || value;
          break;
      }
    }
    return validity;
  }
  return 'Invalid input';
}

function toBoolean(str, expressions) {
  var inversed = 0;
  while (str.indexOf('!') === 0) {
    str = str.replace('!', '');
    inversed++;
  }
  var validity;
  if (str.indexOf('boolExpr') === 0) {
    validity = evalBoolStr(expressions[str], expressions);
  } else if (str == 'true' || str == 'false') {
    validity = str == 'true';
  } else {
    validity = window[str]();
  }
  for (var i = 0; i < inversed; i++) {
    validity = !validity;
  }
  return validity;
}

function a() {
  return false;
}
function b() {
  return true;
}
function c() {
  return true;
}
function d() {
  return false;
}

Usage would then simply be parseBoolStr('true && false'); //false

convert a string containing boolean values to a boolean

3 Answers3