marten-de-vries/evaljs

A JavaScript interpreter written in JavaScript

evaljs's Issues

CallExpression return exception

function calc(a,b){
    return a+b
}
function main(a,b){
    return calc(a,b)
}
console.log(main(1,2)) //output: GeneratorFunctionPrototype [Generator] { _invoke: [Function: invoke] }

debugger for evaljs

Wonderful job. The job is very useful when i want to execute js while eval is disabled. Any ideas for implementing a debugger for evaljs. I think it's will be similar to the sourcemap feature of modern browser, which will make a map between the source code with the uglified code, and provide a great convenience for debugger js.

vm-browserify accomplishes what evaljs attempts without issues in the browser

Hi all,

I was looking for an eval solution that would be safe to use in my browser app.

I checked out evaljs and localeval. localeval provided a safer solution than evaljs and without acorn overhead. Plus localeval protected the global context.

Try some of the warnings in localeval. Scary stuff and evaljs fails these tests.

So I forked localeval and I made a change so that my context data would be retrievable from the eval.

I ran into some issues where the only explanation could have been that my String.prototype.match function was not working correctly, when I pulled localeval the issue went away. So there may still be edge case bugs in localeval?

vm-browserify

In my investigations of my problem I looked into vm-browserify.. This provided the solution to the very same problem by running the eval in its own vm. It looks like this solution is widely used and has millions of downloads. For my case there are no side effects.

With this issue I am hoping I can help out anyone else looking for this solution.

Global functions

I have a question regarding global functions.
How can I add global functions to the env like Boolean or Math?

Like I would like to parse the following:
Boolean("true");
It gives me an empty object {} even if I try to add Boolean like this:

var envGlobal = {
  Boolean: Boolean,
};
var env = new evaljs.Environment([envGlobal]);

If I try the same and add parseInt, if I write like this:
parseInt('5');
It gives me the same empty {} object, however if I do this:
parseInt('5')+5;
It correctly returns 10.

Any idea on this?

Does it use eval under the hood?

Hi there,

Does this use eval() under the hood? If not, do we have any security concerns (XSS or injections) to be aware of?

Thank you