CODEWITHSUNDEEP
javascript
Benjamin Gruenbaum
Benjamin Gruenbaum

Reputation: 276296

Javascript Eval and Function constructor usage

I'm currently experimenting on self replicating code. Out of love for the language I'd like to write it in javascript.

I'm working on a program that writes a function's code which in turn writes its function own code and so on. Basically, the desired process is this:

  1. I manually create A function which returns code (which includes some randomness) and a numeric value (proposed solution to a problem).
  2. I call this function a number of times, evaluate the results of each of those returned functions, and continue the process until I have code that is sufficiently good for what I'm trying to do.

Now, I have always been told how eval is evil, how never to use it and so on. However for my specific use case it seems like the Function constructor or eval are exactly what I'm looking for.

So, in short the question is:

Are eval/Function constructor indeed the best tools to use in my case? If so, I figured I'd use the Function constructor to scope the code executed, but is there a way to truly limit it from accessing the global scope? Also, what are some good practices for eval usage in my case?

Upvotes: 2

Views: 476

Answers (2)

Benjamin Gruenbaum
Benjamin Gruenbaum

Reputation: 276296

I think I just figured out something I could use:

If I run my javascript code using node.js I can use the vm module which allows me to execute javascript code safely in a new context, and without letting the executed code have any access to the local or global scopes.

vm.runInNewContext compiles code, then runs it in sandbox and returns the result. Running code does not have access to local scope. The object sandbox will be used as the global object for code. sandbox and filename are optional, filename is only used in stack traces.

You can see a full example here: vm.runInNewContext

This will allow me to eval code safely, and seems to be the safest way (I found) currently available. I think this is a much better solution than eval or calling the Function constructor.

Thank you everyone who helped.

Upvotes: 1

Woody
Woody

Reputation: 8002

Unfortunately I believe there is no way to prevent it from accessing the global scope. Suppose for example that in a web browser i evaled some code like this :

(function(window) {
   eval(script);
)(null));

Any time the script tries to access window - it will get an error, since window is null. However someone who knew what they were doing could always do this :

var global = (function() {
    return this;
}());

Since when you invoke a function in what Crockford calls the "function invocation style" then the this is always bound to the global variable.

Upvotes: 0

Related Questions