eval() - JavaScript
it is far too easy for a bad actor to run arbitrary code when you use eval().
... see never use eval()!, below.
... the eval() function evaluates javascript code represented as a string.
...And 33 more matches

Object.prototype.eval() - Archive of obsolete content
the object.eval() method used to evaluate a string of javascript code in the context of an object, however, this method has been removed.
...use the top-level eval() function instead.

uneval() - JavaScript
the uneval() function creates a string representation of the source code of an object.
... description uneval() is a top-level function and is not associated with any object.

Downloading JSON and JavaScript in extensions - Archive of obsolete content
once the content has been downloaded, the extension authors proceed to use eval() to decode the string content into javascript objects.
... downloading json if the extension is downloading json, then the developer should be using one of the json decoding methods discussed here and not using eval() at all.
...use the json decoders, not eval()!

Appendix C: Avoiding using eval in Add-ons - Archive of obsolete content
if it cannot be easily proven that an eval() call is benign and necessary because there are no viable alternatives, a mozilla add-ons gallery reviewer will generally reject the submission!
... overriding/extending/amending existing objects (or object properties) again, you might be tempted to uneval(), string replace and eval() existing objects to override them (or at least some properties).
... myaddon.phrases["word" + word] = "phrase"; if there is no way around eval()...

Functions - JavaScript
for example, the following function definition defines myfunc only if num equals 0: var myfunc; if (num === 0) { myfunc = function(theobject) { theobject.make = 'toyota'; } } in addition to defining functions as described here, you can also use the function constructor to create functions from a string at runtime, much like eval().
...thus, in the following code, the this within the function that is passed to setinterval has the same value as this in the enclosing function: function person() { this.age = 0; setinterval(() => { this.age++; // |this| properly refers to the person object }, 1000); } var p = new person(); predefined functions javascript has several top-level, built-in functions: eval() the eval() method evaluates javascript code represented as a string.
... uneval() the uneval() method creates a string representation of the source code of an object.

Security best practices in extensions - Archive of obsolete content
using eval() in an extension using the built-in javascript eval function is frowned upon in the context of extensions.
...this blog post offers some excellent reasons not to use eval().

Index - Archive of obsolete content
once the content has been downloaded, the extension authors proceed to use eval() to decode the string content into javascript objects.
... 2070 object.prototype.eval() javascript, method, object, obsolete the object.eval() method used to evaluate a string of javascript code in the context of an object, however, this method has been removed.

jsdIStackFrame
makes eval() use the last object on its 'obj' param's scope chain as the ecma 'variables object'.
... methods eval() evaluate arbitrary javascript in this stack frame.

Using Web Workers - Web APIs
so for example, suppose a document is served with the following header: content-security-policy: script-src 'self' among other things, this will prevent any scripts it includes from using eval().
... however, if the script constructs a worker, code running in the worker's context will be allowed to use eval().

CSP: script-src - HTTP
'unsafe-eval' allows the use of eval() and similar methods for creating code from strings.
...if 'unsafe-eval' isn't specified with the script-src directive, the following methods are blocked and won't have any effect: eval() function() when passing a string literal like to methods like: window.settimeout("alert(\"hello world!\");", 500); window.settimeout window.setinterval window.setimmediate window.execscript (ie < 11 only) strict-dynamic the 'strict-dynamic' source expression specifies that the trust explicitly given to a script present in the markup, by accompanying it with a nonce or a h...

Property accessors - JavaScript
eval javascript novices often make the mistake of using eval() where the bracket notation can be used instead.
... x = eval('document.forms.form_name.elements.' + strformcontrol + '.value') eval() is slow and should be avoided whenever possible.

Modules - Archive of obsolete content
the use of eval() will probably not be of concern because it is only being used on the exported_symbols array which should not depend on user input.

Using content preferences - Archive of obsolete content
see also nsicontentprefservice nsicontentprefobserver tosource() (potentially useful for serializing objects for later use with eval()) ...

E4X for templating - Archive of obsolete content
0]}</description>, function _else () <label>no data</label> )} note that the simple xmllist() constructor (<></>) may be useful to still be able to use an expression closure (i.e., without needing return statements and braces): {_if(elems.length(), function () <> <markup/> <markup/> </>)} note that, while it is convenient to store such e4x in separate file templates (to be eval()d at a later time, taking into account security considerations, such as escaping with the above), e4x content using such functions can also be easily serialized inline (and then perhaps converted to the dom) as needed: var list = <>{_if(elems.length(), function () <> <markup/> <markup/> </>)}</>.toxmlstring(); iterating functions such as the following foreach (which can work with ...