eval() - JavaScript
the source for this interactive example is stored in a github repository. if you'd like to contribute to the interactive examples project, please clone https://github.com/mdn/interactive-examples and send us a pull request. syntax eval(string) parameters string a string representing a javascript expression, statement, or sequence of statements. ...
...b.com/mdn/interactive-examples and send us a pull request. syntax eval(string) parameters string a string representing a javascript expression, statement, or sequence of statements. the expression can include variables and properties of existing objects. return value the completion value of evaluating the given code. if the completion value is empty, undefined is returned. description eval() is a function property of the global object. the argument of the eval() function is a string. if the string represents an expression, eval() evaluates the expression. if the argument represents one or more javascript statements, eval() evaluates the statements. do not call eval() to evaluate an arithmetic expression; javascript evaluates arithmetic expressions automatically. if you construct an...
...he argument of the eval() function is a string. if the string represents an expression, eval() evaluates the expression. if the argument represents one or more javascript statements, eval() evaluates the statements. do not call eval() to evaluate an arithmetic expression; javascript evaluates arithmetic expressions automatically. if you construct an arithmetic expression as a string, you can use eval() to evaluate it at a later time. for example, suppose you have a variable x. you can postpone evaluation of an expression involving x by assigning the string value of the expression, say "3 * x + 2", to a variable, and then calling eval() at a later point in your script. if the argument of eval() is not a string, eval() returns the argument unchanged. in the following example, the string construc...
...And 22 more matches

Object.prototype.eval() - Archive of obsolete content
the object.eval() method used to evaluate a string of javascript code in the context of an object, however, this method has been removed. syntax obj.eval(string) parameters string any string representing a javascript expression, statement, or sequence of statements. the expression can include variables and properties of existing objects. description the eval method can no longer be used as a method of an object. use the top-level eval() function instead. specifications not part of any standard. ...

uneval() - JavaScript
the uneval() function creates a string representation of the source code of an object. syntax uneval(object) parameters object a javascript expression or statement. return value a string representing the source code of object. note: this will not return a json representation of object. description uneval() is a top-level function and is not associated with any object. examples using uneval var a = 1; uneval(a); // returns a string containing 1 var b = '1'; uneval(b); // returns a string containing "1" uneval(function foo() {}); // returns "(function foo(){})" var a = uneval(function foo() { return 'hi'; }); var foo = eval(a); foo(); // returns "hi" specifications not part of any standard. ...

Downloading JSON and JavaScript in extensions - Archive of obsolete content
this practice is dangerous and will not, in fact, pass an amo review. so the extension will not be allowed to move out of the amo sandbox. ...
...asty actions? fairly easy if the webserver where the javascript is hosted were to be hijacked or compromised. it happens to the best of us. amo takes the threat very seriously. the good news is there are several ways to workaround the problem. ...
...he developer should be using one of the json decoding methods discussed here and not using eval() at all. json is about state and does not allow functions to be decoded. the json decoding methods available to extension developers protect the extension from malicious json and javascript. downloading state from a remote webserver using json is becoming extremely popular. use the json decoders, not eval()! downloading javascript of course there are times when javascript code modules are downloaded and injected into the extension. this usually happens because the extension is trying to keep some of its code fresh and dynamic, and the developers don't want to create a new version of the extension for each script change. in this case, javascript sandboxing should be used to isolate the downloaded j...

Appendix C: Avoiding using eval in Add-ons - Archive of obsolete content
cript code. add-on authors are strongly encouraged to update their code to eliminate all instances of eval, no matter if the add-on is to be hosted in the mozilla add-ons gallery or not. in order to host your add-on with mozilla it is crucial to minimize or completely eliminate eval use in order to receive a positive review and have your add-on made public. if it cannot be easily proven that an eval() call is benign and necessary because there are no viable alternatives, a mozilla add-ons gallery reviewer will generally reject the submission! parsing json mozilla provides native json support since firefox 3. there is simply no need to parse json using eval. additionally, parsing json retrieved from a remote location becomes a security vulnerability when parsed with the eval function. basica...
...atibilities may arise, such as trying to cancel the function call under a certain set of conditions when other add-ons have overridden the same function. again, this is a problem with the "string-patch" method, too. how to handle this is inter-add-on specific and not addressed in this article. overriding/extending/amending existing objects (or object properties) again, you might be tempted to uneval(), string replace and eval() existing objects to override them (or at least some properties). of course, the issues given in the previous section about functions remain. alternative: just assign most of the time, assigning properties will just work. someexistingobject.someproperty = "abc"; // we already demonstrated with with functions in a previous example alternative: object.defineproperty(...
...man, but may also contain security vulnerabilities if you compute the names using external data. alternative: using bracket-access to object properties object properties can always accessed using the bracket syntax: obj["property"] === obj.property hence the following will work just fine without having to resort to eval. myaddon.phrases["word" + word] = "phrase"; if there is no way around eval()... please consider creating an unprivileged sandbox and execute your code by calling evalinsandbox. did i mention that you should use native json methods to parse json data? special thanks special thanks goes to wladimir palant of adblock plus, who wrote an article years back which heavily inspired this one. ...

Index - Archive of obsolete content
lly dangerous) will use all of them. 231 downloading json and javascript in extensions ajax, add-ons, extensions, json, xmlhttprequest a common practice found in many extensions is using xmlhttprequest (or some other mechanism) to download javascript or json (they are different) from a remote website. once the content has been downloaded, the extension authors proceed to use eval() to decode the string content into javascript objects. this practice is dangerous and will not, in fact, pass an amo review. so the extension will not be allowed to move out of the amo sandbox. 233 enhanced extension installation add-ons, extensions no summary! 234 extension etiquette add-ons, extensions, guide no summary! 235 extension library ...
..._nosuchmethod__ property used to reference a function to be executed when a non-existent method is called on an object, but this function is no longer available. 2069 object.prototype.__parent__ javascript, non-standard, object, obsolete, property, prototype the __parent__ property used to point to an object's context, but it has been removed. 2070 object.prototype.eval() javascript, method, object, obsolete the object.eval() method used to evaluate a string of javascript code in the context of an object, however, this method has been removed. 2071 object.prototype.unwatch() debugging, deprecated, javascript, method, object, obsolete, prototype, reference the unwatch() method removes a watchpoint set with the watch() method. 2...

jsdIStackFrame
private data for this object is an nsisupports object. attempting to alter this bit will result in an ns_error_illegal_value. opt_* values above, or'd together. last version set on this context. ...
...nly! line unsigned long current line number (using the script's pc to line map.) read only. pc unsigned long current program counter in this stack frame. read only. scope jsdivalue top object in the scope chain. read only. script jsdiscript script running in this stack frame, null for native frames. read only. thisvalue jsdivalue |this| object for this stack frame. read only. methods eval() evaluate arbitrary javascript in this stack frame. boolean eval( in astring bytes, in autf8string filename, in unsigned long line, out jsdivalue result ); parameters bytes script to be evaluated. filename filename to compile this script under. this is the filename you'll see in error messages, and so on. line result return value ...

CSP: script-src - HTTP
to be used as a content source. 'self' refers to the origin from which the protected document is being served, including the same url scheme and port number. you must include the single quotes. some browsers specifically exclude blob and filesystem from source directives. sites needing to allow these content types can specify them using the data attribute. 'unsafe-eval' allows the use of eval() and similar methods for creating code from strings. you must include the single quotes. 'unsafe-hashes' allows enabling specific inline event handlers. if you only need to allow inline event handlers and not inline <script> elements or javascript: urls, this is a safer method than using the unsafe-inline expression. 'unsafe-inline' allows the use of inline resources, such as inline <script> e...
...pt> tags and note that capitalization and whitespace matter, including leading or trailing whitespace. <script>var inline = 1;</script> unsafe eval expressions the 'unsafe-eval' source expression controls several script execution methods that create code from strings. ...

Functions - JavaScript
in javascript, a function can be defined based on a condition. for example, the following function definition defines myfunc only if num equals 0: var myfunc; if (num === 0) { myfunc = function(theobject) { theobject.make = 'toyota'; } } in addition to defining functions as described here, you can also use the function constructor to create functions from a string at runtime, much like eval(). a method is a function that is a property of an object. read more about objects and methods in working with objects. calling functions defining a function does not execute it. defining it simply names the function and specifies what to do when the function is called. calling the function actually performs the specified actions with the indicated parameters. for example, if you define the fun...
... context is used. thus, in the following code, the this within the function that is passed to setinterval has the same value as this in the enclosing function: function person() { this.age = 0; setinterval(() => { this.age++; // |this| properly refers to the person object }, 1000); } var p = new person(); predefined functions javascript has several top-level, built-in functions: eval() the eval() method evaluates javascript code represented as a string. uneval() the uneval() method creates a string representation of the source code of an object. isfinite() the global isfinite() function determines whether the passed value is a finite number. if needed, the parameter is first converted to a number. isnan() the isnan() function determines whether a value is n...

Modules - Archive of obsolete content
function importmodule (thatobj) { thatobj = thatobj || window; var exported_symbols = [ // put the symbols here ]; // your code here... ...

Security best practices in extensions - Archive of obsolete content
. for pages coming from the server, you need to take steps to ensure that the content can not call back into the web browser and run malicious code. the main way to do this is by creating an iframe or browser element in the sidebar, and loading your content there. give the element a type="content" attribute, which essentially sandboxes the code there and blocks callback rights into chrome. using eval() in an extension using the built-in javascript eval function is frowned upon in the context of extensions. while there are some legitimate use-cases, most of the time there are safer alternatives. this blog post offers some excellent reasons not to use eval(). sandboxed http connections the main purpose of sandboxed http connections is to interact with a web service, without interfering with th...

Using content preferences - Archive of obsolete content
on needed to be stored in memory or preferences had to be avoided. starting in gecko 9.0, when in private browsing mode, the content preference service stores preferences in memory instead of on disk, and automatically forgets them when leaving private browsing mode. see also nsicontentprefservice nsicontentprefobserver tosource() (potentially useful for serializing objects for later use with eval()) ...

E4X for templating - Archive of obsolete content
0]}</description>, function _else () <label>no data</label> )} note that the simple xmllist() constructor (<></>) may be useful to still be able to use an expression closure (i.e., without needing return statements and braces): {_if(elems.length(), function () <> <markup/> <markup/> </>)} note that, while it is convenient to store such e4x in separate file templates (to be eval()d at a later time, taking into account security considerations, such as escaping with the above), e4x content using such functions can also be easily serialized inline (and then perhaps converted to the dom) as needed: var list = <>{_if(elems.length(), function () <> <markup/> <markup/> </>)}</>.toxmlstring(); iterating functions such as the following foreach (which can work with ...

New in JavaScript 1.1 - Archive of obsolete content
otype.join() array.prototype.reverse() array.prototype.sort() array.prototype.split() new operators typeof void other new features <noscript> liveconnect. communication between java and javascript. changed functionality in javascript 1.1 "object deletion". you can remove an object by setting its object reference to null. constructor and prototype properties on objects added. eval() is now a method of every object (was previously a built-in function); it evaluates a string of javascript code in the context of the specified object. math.random() now works on every platform. tostring(): added radix parameter, which specifies the base to use for representing numeric values. isnan() now works on every platform (not only unix anymore) parsefloat() and parseint() now return na...

New in JavaScript 1.4 - Archive of obsolete content
the following is a changelog for javascript 1.4, which was only used for netscape's server side javascript released in 1999. the old netscape documentation can be found on archive.org. ...